ClamAv must have the highest priority on FileValidation Event

Created on 11 August 2025, 8 days ago

Problem/Motivation

Since FileValidations events could access and manipulate uploaded file before ClamAv as a chance to scan it, this module must make it sure that ClamAv is the first event triggered and in case o f virus detection, all remaining events should be skipped.

Steps to reproduce

See https://www.drupal.org/project/clamav/issues/3058018 🐛 Use of Max Resolution on Image Field causes ClamAV Timeout in Deamon mode Needs review

Proposed resolution

Increase priority on FileValidationSubscriber:
https://git.drupalcode.org/project/clamav/-/blob/2.1.x/src/EventSubscrib...

FileValidationEvent::class => ['onFileValidate', 9999],

Skip other events on Drupal\clamav\EventSubscriber\FileValidationSubscriber::onFileValidate, at least at this line
https://git.drupalcode.org/project/clamav/-/blob/2.1.x/src/EventSubscrib...

$event->stopPropagation();

Maybe add an option to configure if it should also fail on FILE_IS_UNCHECKED

Remaining tasks

  1. Check if there's a better way to do this
  2. Provide a MR / patch
  3. Provide tests

User interface changes

none

API changes

none

Data model changes

none

Feature request
Status

Active

Version

2.1

Component

Code

Created by

🇫🇷France o'briat Nantes

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024