|
I've added some general information to the user guide on interaction with virus
scanners, and this will appear on the web site on the next refresh. I consider the details of integrating virus scanning into an application to be see https://bugzilla.mozilla.org/show_bug.cgi?id=103487
 for ideas how to handlethis for UAs (browser/mail) and pointers re "the Microsoft way" |
|||||||||||||||||||||||||||||||||||||||||||||||||||||
 |
|
Improvement
Closed
Minor
Documentation: illustrate how to integrate virus control
immediately after they are written, as a minimal level of integration.
Introducing a slight delay in processing the files is enough to ensure that they
have been scanned. Our customers have various virus scanners and this has worked
for all of them.
Of course, this isn't ideal, as if the scanner is off, or slow, the file will
still be there next time you look. Using on-demand scanning is slightly better
as you'll never get data from the file until after the scanner has kicked in. To
test this mechanism, use the eicar test files.
http://www.eicar.org/anti_virus_test_file.htm
For a more complete solution, AV vendors seem to be aligning around ICAP
) as a way of plugging in to HTTP servers.
(http://www.i-cap.org/spec/rfc3507.txt
ICAP modifies HTTP requests/responses, so you'd have a proxy that used ICAP to
talk to an enterprise AV product. Notification appears in headers of the
modified request, see:
http://www.i-cap.org/spec/draft-stecher-icap-subid-00.txt
So you MAY get an 'X-Infection-Found' header if there's a virus; ie what the
header /actually/ is may vary from vendor to vendor, but you should see
something. Hence, with ICAP available, best practice would be to test for the
presence of a configurable infection-flagging header prior to parsing the file
upload.
Of course you wouldn't have been able to figure that out from the ICAP forum's
... (is this a joke?)
wonderfully opaque and probably autogenerated 'about' page:
http://www.i-cap.org/about/