Thore Cimbal
42285021cb
Synapse's own check_media_file_for_spam module can never see E2EE attachment content - only the client ever holds the decryption key. Adds two hooks that call a self-hosted scan service (https://axion1337.chat/_scan, deployed separately in the gitops repo): - DecryptFile.ts: scans every decrypted attachment (image/audio/video/ file all funnel through this one function via MediaEventHelper) before returning it as a Blob. - ContentMessages.ts: scans plaintext before encryption/upload in uploadFile(), the shared function behind all attachment uploads (main file, thumbnails, voice messages), regardless of room encryption state. New ContentScanRejectedError surfaces through the existing error- rendering paths (MediaProcessingError, upload failure dialog) using the same pattern as DecryptError/DownloadError/UploadFailedError. Live-tested: EICAR blocked pre-upload in encrypted rooms and DMs; receive-side hook also blocks EICAR sent by an unpatched client (app.element.io), confirming it isn't just self-protection for our own uploads. Fails open on scanner errors so an outage can't block all uploads/downloads.
64 lines
2.4 KiB
TypeScript
64 lines
2.4 KiB
TypeScript
/*
|
|
Copyright 2026 aXion1337
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
|
|
Please see LICENSE files in the repository root for full details.
|
|
*/
|
|
|
|
// Client-side ClamAV scanning (Issue #19 extension): Synapse's own server-side spam-checker
|
|
// module can never see E2EE attachment content - only a cooperating client can, since only
|
|
// the client ever holds the room's decryption key. This calls a small self-hosted scan
|
|
// service (same ClamAV instance the server-side module uses) directly from the browser, both
|
|
// before encrypting/uploading a file and after downloading/decrypting one - see
|
|
// ContentMessages.ts (send) and DecryptFile.ts (receive) for the two call sites.
|
|
|
|
import { logger } from "matrix-js-sdk/src/logger";
|
|
|
|
export class ContentScanRejectedError extends Error {
|
|
public readonly signature: string;
|
|
|
|
public constructor(signature: string) {
|
|
super(`Blocked by content scanner: ${signature}`);
|
|
this.name = "ContentScanRejectedError";
|
|
this.signature = signature;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Scans plaintext bytes against the self-hosted ClamAV scan service.
|
|
* Fails open (resolves normally) on any network/scanner-side error, matching the same
|
|
* fail-open policy as the server-side Synapse module - a scanner outage should not block
|
|
* uploads or downloads site-wide.
|
|
* @throws {ContentScanRejectedError} if the scanner positively identifies the content as infected.
|
|
*/
|
|
export async function scanContent(data: ArrayBuffer | ArrayBufferView, accessToken: string): Promise<void> {
|
|
let response: Response;
|
|
try {
|
|
response = await fetch("/_scan", {
|
|
method: "POST",
|
|
headers: { Authorization: `Bearer ${accessToken}` },
|
|
body: data as BodyInit,
|
|
});
|
|
} catch (e) {
|
|
logger.warn("Content scan request failed (scanner unreachable?) - allowing through", e);
|
|
return;
|
|
}
|
|
|
|
if (!response.ok) {
|
|
logger.warn("Content scan request failed with status", response.status, "- allowing through");
|
|
return;
|
|
}
|
|
|
|
let result: { clean: boolean; signature?: string };
|
|
try {
|
|
result = await response.json();
|
|
} catch (e) {
|
|
logger.warn("Content scan response was not valid JSON - allowing through", e);
|
|
return;
|
|
}
|
|
|
|
if (result.clean === false) {
|
|
throw new ContentScanRejectedError(result.signature ?? "unknown");
|
|
}
|
|
}
|