run avScan in tmp dirs (#2113)

Enterprise-CMCS · Dec 14, 2023 · ef65829 · ef65829
1 parent e0fab73
commit ef65829
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 19 deletions.
diff --git a/services/uploads/jest.config.ts b/services/uploads/jest.config.ts
@@ -21,4 +21,7 @@ module.exports = {
     moduleFileExtensions: ['js', 'json', 'jsx', 'd.ts', 'ts', 'node'],
     coveragePathIgnorePatterns: [],
     modulePathIgnorePatterns: ['local_buckets'],
+    moduleNameMapper: {
+        '^uuid$': require.resolve('uuid'),
+    },
 }
diff --git a/services/uploads/src/lambdas/avScan.ts b/services/uploads/src/lambdas/avScan.ts
@@ -81,8 +81,7 @@ async function avScan(event: S3Event, _context: Context) {
             clamAV,
             s3ObjectKey,
             s3ObjectBucket,
-            maxFileSize,
-            '/tmp/downloads'
+            maxFileSize
         )
 
         // Record the duration of the av scan

diff --git a/services/uploads/src/lib/avScan.test.ts b/services/uploads/src/lib/avScan.test.ts
@@ -12,7 +12,6 @@ describe('avScan', () => {
     it('tags clean for a clean file', async () => {
         const thisDir = __dirname
         const tmpDefsDir = await mkdtemp('/tmp/freshclam-')
-        const tmpScanDir = await mkdtemp('/tmp/clamscan-')
 
         const s3Client = NewTestS3UploadsClient()
 
@@ -61,7 +60,6 @@ describe('avScan', () => {
             goodFileKey,
             'test-uploads',
             MAX_FILE_SIZE,
-            tmpScanDir
         )
         if (scanResult instanceof Error) {
             throw scanResult
@@ -78,13 +76,11 @@ describe('avScan', () => {
         expect(virusScanStatus(res2)).toBe('CLEAN')
 
         await rm(tmpDefsDir, { force: true, recursive: true })
-        await rm(tmpScanDir, { force: true, recursive: true })
     })
 
     it('marks infected for an infected file', async () => {
         const thisDir = __dirname
         const tmpDefsDir = await mkdtemp('/tmp/freshclam-')
-        const tmpScanDir = await mkdtemp('/tmp/clamscan-')
 
         const s3Client = NewTestS3UploadsClient()
 
@@ -133,7 +129,6 @@ describe('avScan', () => {
             badFileKey,
             'test-uploads',
             MAX_FILE_SIZE,
-            tmpScanDir
         )
         if (scanResult instanceof Error) {
             throw scanResult
@@ -150,13 +145,11 @@ describe('avScan', () => {
         expect(virusScanStatus(res2)).toBe('INFECTED')
 
         await rm(tmpDefsDir, { force: true, recursive: true })
-        await rm(tmpScanDir, { force: true, recursive: true })
     })
 
     it('marks skipped for too big a file (config a smaller max size)', async () => {
         const thisDir = __dirname
         const tmpDefsDir = await mkdtemp('/tmp/freshclam-')
-        const tmpScanDir = await mkdtemp('/tmp/clamscan-')
 
         const s3Client = NewTestS3UploadsClient()
 
@@ -205,7 +198,6 @@ describe('avScan', () => {
             badFileKey,
             'test-uploads',
             2,
-            tmpScanDir
         )
         if (scanResult instanceof Error) {
             throw scanResult
@@ -222,13 +214,11 @@ describe('avScan', () => {
         expect(virusScanStatus(res2)).toBe('SKIPPED')
 
         await rm(tmpDefsDir, { force: true, recursive: true })
-        await rm(tmpScanDir, { force: true, recursive: true })
     })
 
     it('marks error if ClamAV errors', async () => {
         const thisDir = __dirname
         const tmpDefsDir = await mkdtemp('/tmp/freshclam-')
-        const tmpScanDir = await mkdtemp('/tmp/clamscan-')
 
         const s3Client = NewTestS3UploadsClient()
 
@@ -281,7 +271,6 @@ describe('avScan', () => {
             badFileKey,
             'test-uploads',
             MAX_FILE_SIZE,
-            tmpScanDir
         )
         if (scanResult instanceof Error) {
             throw scanResult
@@ -298,13 +287,11 @@ describe('avScan', () => {
         expect(virusScanStatus(res2)).toBe('ERROR')
 
         await rm(tmpDefsDir, { force: true, recursive: true })
-        await rm(tmpScanDir, { force: true, recursive: true })
     })
 
     it('returns not found if the key doesnt exist', async () => {
         const thisDir = __dirname
         const tmpDefsDir = await mkdtemp('/tmp/freshclam-')
-        const tmpScanDir = await mkdtemp('/tmp/clamscan-')
 
         const s3Client = NewTestS3UploadsClient()
 
@@ -336,14 +323,12 @@ describe('avScan', () => {
             badFileKey,
             'test-uploads',
             MAX_FILE_SIZE,
-            tmpScanDir
         )
         if (!(scanResult instanceof Error)) {
             throw new Error('Didnt error on a nonexistant file')
         }
         expect(scanResult.name).toBe('NotFound')
 
         await rm(tmpDefsDir, { force: true, recursive: true })
-        await rm(tmpScanDir, { force: true, recursive: true })
     })
 })
diff --git a/services/uploads/src/lib/avScan.ts b/services/uploads/src/lib/avScan.ts
@@ -1,4 +1,5 @@
 import { S3UploadsClient } from '../deps/s3'
+import { mkdtemp } from 'fs/promises'
 import { ClamAV } from '../deps/clamAV'
 import { generateVirusScanTagSet, ScanStatus } from './tags'
 import { scanFiles } from './scanFiles'
@@ -9,7 +10,6 @@ export async function scanFile(
     key: string,
     bucket: string,
     maxFileSize: number,
-    scanDir: string
 ): Promise<undefined | Error> {
     //You need to verify that you are not getting too large a file
     //currently lambdas max out at 500MB storage.
@@ -24,12 +24,16 @@ export async function scanFile(
         // tag with skipped.
         tagResult = 'SKIPPED'
     } else {
+
+        // make a tmp directory to scan this file in
+        const tmpScanDir = await mkdtemp('/tmp/clamscan-')
+
         const infectedFiles = await scanFiles(
             s3Client,
             clamAV,
             [key],
             bucket,
-            scanDir
+            tmpScanDir
         )
 
         if (infectedFiles instanceof Error) {
@@ -41,6 +45,7 @@ export async function scanFile(
                 tagResult = 'INFECTED'
             }
         }
+
     }
 
     const tags = generateVirusScanTagSet(tagResult)