File quarantine and scanning

File Quarantine & Malware Scanning

When an application accepts documents, archives, attachments or shared files that other users, admins or support agents will download, a newly uploaded file must be treated as untrusted and quarantined until content validation and malware scanning complete.

1. Two-Stage Quarantine -> Clean Storage Topology

Isolate unverified uploads from verified production files:

1. Quarantine / Staging Zone (quarantine-bucket or quarantine/ prefix):
   • Direct client uploads land exclusively in the quarantine location.
   • Fail-closed access: the application's download, preview and sharing endpoints refuse to serve any file whose status is not 'ready' (scan_status === 'clean'). Even the uploader cannot generate a public share link for an unverified file.
   • Configure a short automatic lifecycle expiration (e.g., 24–48 hours) on the quarantine bucket so abandoned or rejected uploads are purged automatically.
2. Asynchronous Inspection & Malware Scan:
   • A background worker (or cloud object-created event trigger) streams the quarantined object through:
     • Byte-size and magic-byte header verification.
     • Malware scanner (clamd instream socket / ClamAV, AWS GuardDuty S3 Malware Protection, Defender for Storage, or VirusTotal/hash check).
     • Format-specific structural checks (e.g., rejecting encrypted/password-protected archives when policy forbids unscannable containers, or checking PDF for /JS / /JavaScript / /Launch actions).
3. Promotion or Rejection:
   • clean: copy/move the object to the permanent storage key, record scan_status = 'clean', scanned_at, scanner_version / signature version, delete the quarantine object, and trigger preview generation.
   • infected / suspicious: transition file status to 'rejected', delete or isolate the quarantine object per security incident policy, release reserved user quota, and log a structured security event (with user ID, IP, SHA-256 hash and threat name — never logging the raw payload).
   • scan_error / scanner unavailable: keep the file in 'verifying' and retry with backoff; never fail-open by marking a file 'clean' just because the virus scanner timed out!

2. Defense-in-Depth Beyond Antivirus Signatures

Never claim that a passing antivirus scan guarantees a file is 100% safe:

• Signature scanners miss zero-day macros, polyglot files (e.g., a valid GIF that is also a valid JS/JAR file), HTML smuggling and SSRF/XXE payloads inside XML-based formats (.svg, .docx, .xlsx).
• Content Disarmament / Re-encoding: for images, re-encoding pixels to a fresh WebP/PNG/JPEG strips appended polyglot payloads and metadata exploits.
• Strict Egress Headers: even after a file is marked 'clean', serve it from an isolated domain with X-Content-Type-Options: nosniff, Content-Security-Policy: sandbox and Content-Disposition: attachment for non-media documents.