Skip to main content
Jahia Store
EN

ClamAV filter

community
Download 1.0.1

Information

Module ID
clamav-filter
Group ID
org.jahia.community
Status
community
Category
Security
Author
Florent BOURASSE
Developer website
http://www.jahia.com
Requires Jahia
8.2.1.0
Updated
2026-07-09
Source
scm:git:git@github.com:Jahia/clamav-filter.git
Tags
  • security

A Jahia module that scans uploaded files against a ClamAV antivirus daemon and blocks any upload containing detected malware.

Screenshots

Versions

Highlights

  • Security hardening of the ClamAV filter pipeline: bounded request buffering, fail-closed on scanner unavailability, SSRF input validation, and TOCTOU mitigation.
  • Full WCAG 2.1 AA audit remediation plus push to AAA 7:1 contrast across the admin UI.
  • Dependency vulnerability fixes (Dependabot/CVE) on @babel/plugin-transform-modules-systemjs and systeminformation.
  • Project guidance docs (AGENTS.md / CLAUDE.md) added for AI-assisted development.

Fixes

Security (431fe9d)

  • MultiReadHttpServletRequest: bound buffered body by configurable max size; throws RequestTooLargeException → HTTP 413 to prevent unauthenticated heap DoS.
  • ClamavFilter: scoped to scan-eligible requests, forwards the wrapped request downstream so scanned bytes equal consumed bytes (closes TOCTOU); fails-closed with HTTP 503 when ClamAV is unreachable instead of silently passing uploads.
  • clamavSaveSettings mutation: validates host charset/length, port range and timeout bounds to block scanner-rewrite SSRF that could bypass scanning.
  • clamavScanTest: caps base64 input length to prevent decode DoS.
  • ClamavServiceImpl: bounded INSTREAM reply reads, CRLF-stripped/truncated log messages, explicit US-ASCII/UTF-8, defensive bounds checks in populateVirusScanResult.
  • ClamavConfig: atomic full-update validation; fields made volatile.

Accessibility — WCAG 2.1 AA (ec95a77c275ea8)

  • aria-hidden="true" on alert icon spans (✓ / ✕) to stop AT reading Unicode names.
  • aria-live="polite" on filename display; kept always in DOM so selection is announced.
  • Replaced 3 dynamic-role live regions with 6 fixed alert+status pairs (save / ping / scan) for stable AT subscriptions.
  • Removed focus() calls on sr-only divs after async ops; aria-live announces without stealing focus.
  • 4 px left accent border on alert boxes for boundary contrast.
  • aria-describedby host-input format hint; tooltip colour darkened #767676 → #6b6b6b.
  • aria-describedby + sr-only rationale on disabled scan section.

Accessibility — WCAG 2 AAA 7:1 contrast (0833b6b3979225)

  • Alert success text: #2e7d32 → #1b5e20 → #175217 (final ~8.3:1 on #e8f5e9).
  • Alert error text: #c62828 → #9e1a1a (~7.1:1 on #fdecea).
  • Buttons/labels: #0077cc → #004a80 (~9.2:1 on white).
  • Input focus borders/outlines aligned for consistency.

Dependency / CVE

  • 2229fbc — upgrade systeminformation 5.31.5 → 5.31.6 via resolution (CVE fix).
  • c5c9a42 — upgrade @babel/plugin-transform-modules-systemjs (Dependabot alert).

Refactoring

  • ClamavFilter / MultiReadHttpServletRequest / ClamavServiceImpl / ClamavConfig substantially reworked alongside the security fix (431fe9d) — clearer scoping, explicit charsets, atomic config swaps.
  • ClamavConstants extended with new bounds/error constants.
  • GraphQL extensions (ClamavMutationExtensionClamavQueryExtension) reorganised around input validation and error reporting.
  • UI components (ClamavFilter.jsx / .scss) restructured around fixed live-region pairs and contrast-compliant tokens.
  • Locale en.json updated for new validation and accessibility messages.

Tests

  • tests/package.json and tests/yarn.lock updated (dependency bumps); no new test commits identified in range.

Docs / Tooling

  • cba8b9d — add Claude basic context.
  • 38113e3 — rename CLAUDE.md to AGENTS.md, add CLAUDE.md reference shim.

Full Changelog1_0_0...1_0_1

Requires Jahia 8.2.1.0Updated 2026-05-19
Requires Jahia 8.2.1.0Updated 2026-04-18