Virus scanning

A browser can't scan files for malware, so UploadCN never pretends to. Scanning happens in your upload route, after the file is stored and before the upload completes. The UI only reflects the verdict.

Add it to your routeCopy Anchor Link

import { clamavScanner } from "@uploadcn/server/scan"

const scanner = clamavScanner({ host: process.env.CLAMAV_HOST })

export const { POST } = createUploadRoute({
  storage,
  scan: { scanner },
})

The upload route from npx shadcn@latest add @uploadcn/upload-route already does this when CLAMAV_HOST or VIRUSTOTAL_API_KEY is set.

ScannersCopy Anchor Link

docker run -d -p 3310:3310 clamav/clamav:stable

import { clamavScanner } from "@uploadcn/server/scan"

const scanner = clamavScanner({
  host: process.env.CLAMAV_HOST, // or socketPath: "/run/clamav/clamd.sock"
  port: 3310,
  timeout: 60_000,
})

await scanner.ping() // true when clamd answers, for health checks

OptionsCopy Anchor Link

onUploadComplete receives the verdict as scan, and the client's item.result.scan says { status: "clean", scanner: "clamav" }. Threat names stay on the server.

createUploadRoute({
  storage,
  scan: {
    scanner,
    onResult: async ({ key, result, auth }) => {
      if (result.status === "infected") await alertSecurityTeam({ key, user: auth, threats: result.threats })
    },
  },
  async onUploadComplete({ key, scan }) {
    await db.files.create({ key, scannedBy: scan?.scanner })
  },
})

Storage requirementsCopy Anchor Link

Scanning reads the stored object back, so the storage must implement getObject: s3Storage, r2Storage and createFileSystemStorage do. createMemoryStorage keeps no bytes and can't be scanned.

Keep unscanned files privateCopy Anchor Link

With presigned uploads the bytes reach your bucket before the scan. Keep the bucket private (no publicUrl) so nobody can download a file until complete returns, or upload to a quarantine prefix and copy clean files to their final location in onUploadComplete.

Large files and background scansCopy Anchor Link

Scanning inline holds the complete request open. For multi-gigabyte files, scan in the background instead: skip scan, start a job in onUploadComplete, and drive the item from your job's result with process or uploader.update. See Processing & scanning.

On AWS, GuardDuty Malware Protection for S3 scans new objects and tags them with GuardDutyMalwareScanStatus; poll that tag from process, or wrap it in createScanner.

Test itCopy Anchor Link

The EICAR test file is harmless, and every scanner reports it as infected. Upload it to check the whole flow end to end.