FLS-448 Malware virus scanning for client side file upload (#195)

nuwan-samarasinghe · web-flow · commit 95418b9b8dfe · 2025-07-14T09:40:17.000+01:00
* Malware scanning for client side file upload

* Fix e2e test to have malware detection changes

* Disable Virus scan capability in local development but enable in e2e

* Adding in-progress state till file gets the tag

* Change endpoint into POST to a check and delete file based on the tag from guard duty

* Addressing review comments

* Adding .env to get AWS params

* Sonar fix
diff --git a/.github/workflows/copilot_deploy.yml b/.github/workflows/copilot_deploy.yml
@@ -295,6 +295,11 @@ jobs:
       - name: Start containers
         run: docker compose -f docker-compose.e2e.yml up -d
 
+      - name: Add localstack to /etc/hosts
+        run: |
+            echo "127.0.0.1 localhost localstack host.docker.internal" | sudo tee -a /etc/hosts
+            cat /etc/hosts
+
       - name: Create S3 bucket
         run: docker exec localstack /bin/sh -c "awslocal s3api create-bucket --bucket fsd-bucket --create-bucket-configuration LocationConstraint=eu-west-2 --region eu-west-2"
 
diff --git a/copilot/fsd-form-runner-adapter/manifest.yml b/copilot/fsd-form-runner-adapter/manifest.yml
@@ -71,6 +71,7 @@ variables:
   SINGLE_REDIS: true
   JWT_AUTH_COOKIE_NAME: "fsd_user_token"
   JWT_AUTH_ENABLED: true
+  ENABLE_VIRUS_SCAN: true
   LOG_PRETTY_PRINT: false
 
 secrets:
diff --git a/docker-compose.e2e.yml b/docker-compose.e2e.yml
@@ -44,6 +44,7 @@ services:
       - SINGLE_REDIS=true
       - FORM_RUNNER_ADAPTER_REDIS_INSTANCE_URI=redis://redis-data:6379
       - PREVIEW_MODE=true
+      - ENABLE_VIRUS_SCAN=true
     command: yarn runner start:test
     logging:
       driver: "json-file"
diff --git a/e2e-test/cypress.config.js b/e2e-test/cypress.config.js
@@ -2,10 +2,12 @@ const {defineConfig} = require("cypress");
 const webpack = require("@cypress/webpack-preprocessor");
 const preprocessor = require("@badeball/cypress-cucumber-preprocessor");
 const path = require("path");
+const AWS = require('aws-sdk');
+const dotenv = require("dotenv");
+dotenv.config({ path: path.resolve(__dirname, "../docker-localstack/.awslocal.env") });
 
 
 console.log("****************** starting e2e ******************")
-console.log(`e2e entry : [${path.resolve(__dirname, "../digital-form-builder/e2e")}]\n`)
 
 async function setupNodeEvents(on, config) {
   // This is required for the preprocessor to be able to generate JSON reports after each run, and more,
@@ -33,6 +35,45 @@ async function setupNodeEvents(on, config) {
       },
     })
   );
+
+  on('task', {
+    async tagAllS3Objects({ tags }) {
+      console.log('tagAllS3Objects task started with tags:', tags);
+      const s3 = new AWS.S3({
+        endpoint: process.env.AWS_ENDPOINT_OVERRIDE,
+        s3ForcePathStyle: true,
+        accessKeyId: process.env.AWS_ACCESS_KEY_ID,
+        secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
+        region: process.env.AWS_DEFAULT_REGION,
+      });
+      try {
+        const listedObjects = await s3.listObjectsV2({ Bucket: 'fsd-bucket' }).promise();
+        if (!listedObjects.Contents || listedObjects.Contents.length === 0) {
+          const msg = `No objects found in bucket fsd-bucket`;
+          console.log(msg);
+          return msg;
+        }
+        const taggingPromises = listedObjects.Contents.map((obj) => {
+          console.log(`Tagging object: ${obj.Key}`);
+          return s3.putObjectTagging({
+            Bucket: 'fsd-bucket',
+            Key: obj.Key,
+            Tagging: {
+              TagSet: Object.entries(tags).map(([Key, Value]) => ({ Key, Value })),
+            },
+          }).promise();
+        });
+        await Promise.all(taggingPromises);
+        const successMsg = `${listedObjects.Contents.length} object(s) in fsd-bucket tagged successfully.`;
+        console.log(successMsg);
+        return successMsg;
+      } catch (error) {
+        console.error("Error tagging S3 objects:", error);
+        throw error;
+      }
+    },
+  });
+
   // Make sure to return the config object as it might have been modified by the plugin
   return config;
 }
diff --git a/e2e-test/cypress/e2e/runner/clientSideFileUpload.feature b/e2e-test/cypress/e2e/runner/clientSideFileUpload.feature
@@ -13,7 +13,6 @@ Feature: Client Side File Upload
     And I continue
     Then I see the error "Test Client Side file Upload is required" for "Upload the independent survey of works" component with problem title
 
-  @wip
   Scenario: Adding a single file into the client side file upload
     And the form session will be initiated with the given component type "text" key "clientSideFileUploadField1" title "Upload the independent survey of works" answer "" question "Upload the independent survey of works" and finally form "client-side-file-upload-single" and session "045a5791-1d76-45e6-a926-7d4ff26b4113"
       | form                           | redirectPath |
@@ -33,5 +32,12 @@ Feature: Client Side File Upload
     When I upload the file "passes.png" wait till upload
     Then I see the error "Test Client Side file Upload requires 2 files" for "Upload the independent survey of works" component with problem title
 
-
+  Scenario: Adding a single file into the client side file upload with a virus
+    And the form session will be initiated with the given component type "text" key "clientSideFileUploadField1" title "Upload the independent survey of works" answer "" question "Upload the independent survey of works" and finally form "client-side-file-upload-single" and session "045a5791-1d76-45e6-a926-7d4ff26b4113"
+      | form                           | redirectPath |
+      | client-side-file-upload-single | /            |
+    And I go to the initialised session URL with generated token
+    And I continue
+    When I upload the file "passes.png" with virus then wait till upload
+    Then I see the error "The selected file contains a virus" for "Upload the independent survey of works" component with problem title
 
diff --git a/e2e-test/cypress/support/step_definitions/runner/i_upload_a_file_and_continue.js b/e2e-test/cypress/support/step_definitions/runner/i_upload_a_file_and_continue.js
@@ -1,7 +1,14 @@
 import {When} from "@badeball/cypress-cucumber-preprocessor";
 
 When("I upload the file {string} wait till upload", (filename) => {
-  cy.get("input[type=file]").attachFile(filename);
-  cy.wait(2000)
-  cy.findByRole("button", {name: /continue/i}).click();
+  cy.get("input[type=file]").attachFile(filename, { force: true });
+  cy.wait(5000);
+  const tags = {
+    GuardDutyMalwareScanStatus: 'NO_THREATS_FOUND'
+  };
+  cy.task('tagAllS3Objects', { tags }).then(() => {
+    cy.wait(5000);
+    cy.log('tagAllS3Objects task completed');
+    cy.findByRole("button", { name: /continue/i }).click();
+  });
 });
diff --git a/e2e-test/cypress/support/step_definitions/runner/i_upload_a_file_with_virus.js b/e2e-test/cypress/support/step_definitions/runner/i_upload_a_file_with_virus.js
@@ -0,0 +1,13 @@
+import {When} from "@badeball/cypress-cucumber-preprocessor";
+
+When("I upload the file {string} with virus then wait till upload", (filename) => {
+  cy.get("input[type=file]").attachFile(filename);
+  cy.wait(5000);
+  const tags = {
+    GuardDutyMalwareScanStatus: 'THREATS_FOUND'
+  };
+  cy.task('tagAllS3Objects', { tags }).then(() => {
+    cy.wait(5000);
+    cy.log('tagAllS3Objects task completed');
+  });
+});
diff --git a/runner/config/custom-environment-variables.json b/runner/config/custom-environment-variables.json
@@ -69,5 +69,6 @@
   "ignoreSectionsFromSummary": "IGNORE_SECTIONS_FROM_SUMMARY_PAGE",
   "sentryDsn": "SENTRY_DSN",
   "sentryTracesSampleRate": "SENTRY_TRACES_SAMPLE_RATE",
-  "copilotEnv": "COPILOT_ENV"
+  "copilotEnv": "COPILOT_ENV",
+  "enableVirusScan": "ENABLE_VIRUS_SCAN"
 }
diff --git a/runner/config/default.js b/runner/config/default.js
@@ -112,5 +112,7 @@ module.exports = {
   /*sentry configurations*/
   sentryDsn: "",
   sentryTracesSampleRate: "",
-  copilotEnv: ""
+  copilotEnv: "",
+
+  enableVirusScan: false,
 };
diff --git a/runner/locales/cy.json b/runner/locales/cy.json
@@ -24,6 +24,7 @@
       "filePartiallyUploadError": "Nid yw'r ffeiliau wedi'u llwytho i fyny yn llawn",
       "fileUploadSizeError": "Rhaid i'r ffeil fod o dan ",
       "fileUploadCombinedSizeError": "Rhaid i faint ffeiliau cyfun fod o dan ",
+      "fileUploadVirusError": "The selected file contains a virus",
       "fileUploadTypeError": "Ni allwch uwchlwytho ffeiliau o'r math hwn.",
       "fileUploadCountSingleError": "Dim ond un ffeil y gallwch ei uwchlwytho",
       "fileUploadCountMaxError": "Dim ond ffeiliau {maxFiles} y gallwch chi eu huwchlwytho",
@@ -52,6 +53,7 @@
         "fileActionCol": "Gweithredu",
         "fileActionComplete": "Cyflawn",
         "fileActionFailed": "Wedi methu",
+        "fileActionInProgress": "In progress",
         "deleteBtn": "Dileu"
       }
     },
diff --git a/runner/locales/en.json b/runner/locales/en.json
@@ -24,6 +24,7 @@
 			"filePartiallyUploadError": "The files have not fully uploaded",
 			"fileUploadSizeError": "File must be under ",
 			"fileUploadCombinedSizeError": "Combined filesize must be under ",
+      "fileUploadVirusError": "The selected file contains a virus",
 			"fileUploadTypeError": "You can't upload files of this type.",
 			"fileUploadCountSingleError": "You can only upload a single file",
 			"fileUploadCountMaxError": "You can only upload {maxFiles} files",
@@ -52,6 +53,7 @@
 				"fileActionCol": "Action",
 				"fileActionComplete": "Complete",
 				"fileActionFailed": "Failed",
+        "fileActionInProgress": "In progress",
 				"deleteBtn": "Delete"
 			}
 		},
@@ -102,4 +104,4 @@
 		"accessibilityStatement": "Accessibility Statement",
 		"contactUs": "Contact Us"
 	}
-}
+}
diff --git a/runner/src/server/plugins/engine/api/RegisterS3FileUploadApi.ts b/runner/src/server/plugins/engine/api/RegisterS3FileUploadApi.ts
@@ -3,6 +3,9 @@ import {HapiRequest, HapiResponseToolkit, HapiServer} from "../../../types";
 import {jwtAuthStrategyName} from "../Auth";
 import {config} from "../../utils/AdapterConfigurationSchema";
 
+const GUARD_DUTY_MALWARE_SCAN_STATUS = 'GuardDutyMalwareScanStatus';
+const THREATS_FOUND = 'THREATS_FOUND';
+const NO_THREATS_FOUND = "NO_THREATS_FOUND";
 
 export class RegisterS3FileUploadApi implements RegisterApi {
     register(server: HapiServer): void {
@@ -11,18 +14,10 @@ export class RegisterS3FileUploadApi implements RegisterApi {
             method: "POST",
             path: "/s3/{id}/{pageKey}/{componentKey}/create-pre-signed-url",
             handler: async (request: HapiRequest, h: HapiResponseToolkit) => {
-                const {query} = request;
-                const {s3UploadService, adapterCacheService} = request.services([]);
-                //@ts-ignore
-                const state = await adapterCacheService.getState(request);
-                let form_session_identifier = state.metadata?.form_session_identifier ?? "";
-                if (query.form_session_identifier) {
-                    form_session_identifier = query.form_session_identifier;
-                }
-                if (!form_session_identifier) {
-                    return h.response({ok: false}).code(401);
-                }
-                const {id, pageKey, componentKey} = request.params as any;
+                const {
+                    //@ts-ignore
+                    s3UploadService, adapterCacheService, form_session_identifier, id, pageKey, componentKey
+                } = await this.extractRequestData(request, h);
                 //@ts-ignore
                 const {filename} = request.payload;
                 request.logger.info(`[RegisterS3FileUploadApi] uploading the file ${filename}`);
@@ -59,18 +54,11 @@ export class RegisterS3FileUploadApi implements RegisterApi {
             method: "GET",
             path: "/s3/{id}/{pageKey}/{componentKey}/download-file",
             handler: async (request: HapiRequest, h: HapiResponseToolkit) => {
-                const {query} = request;
-                const {s3UploadService, adapterCacheService} = request.services([]);
+                const {
+                    //@ts-ignore
+                    s3UploadService, form_session_identifier, id, pageKey, componentKey
+                } = await this.extractRequestData(request, h);
                 //@ts-ignore
-                const state = await adapterCacheService.getState(request);
-                let form_session_identifier = state.metadata?.form_session_identifier ?? "";
-                if (query.form_session_identifier) {
-                    form_session_identifier = query.form_session_identifier;
-                }
-                if (!form_session_identifier) {
-                    return h.response({ok: false}).code(401);
-                }
-                const {id, pageKey, componentKey} = request.params as any;
                 const {filename} = request.query;
 
                 const key = `${form_session_identifier}/${id}/${pageKey}/${componentKey}/${filename}`;
@@ -87,22 +75,55 @@ export class RegisterS3FileUploadApi implements RegisterApi {
 
         server.route(s3GetDataOptions);
 
+        const s3CheckTagsAndDelete: any = {
+            method: "POST",
+            path: "/s3/{id}/{pageKey}/{componentKey}/check-tags-and-delete",
+            handler: async (request: HapiRequest, h: HapiResponseToolkit) => {
+                const {
+                    //@ts-ignore
+                    s3UploadService, form_session_identifier, id, pageKey, componentKey
+                } = await this.extractRequestData(request, h);
+                //@ts-ignore
+                const {filename} = request.payload;
+
+                const key = `${form_session_identifier}/${id}/${pageKey}/${componentKey}/${filename}`;
+                if (config.enableVirusScan === "true") {
+                    const tagsForTheFile = await s3UploadService.getFileTagsS3(key);
+                    const malwareScanTag = tagsForTheFile.tags.find(tag => tag.Key === GUARD_DUTY_MALWARE_SCAN_STATUS);
+                    if (malwareScanTag && malwareScanTag.Value === THREATS_FOUND) {
+                        await s3UploadService.deleteFileS3(key);
+                    }
+                    return tagsForTheFile;
+                } else {
+                    // Local development purposes we ignore using actual Guard-duty service
+                    return {
+                        tags: [
+                            {
+                                Key: GUARD_DUTY_MALWARE_SCAN_STATUS,
+                                Value: NO_THREATS_FOUND
+                            }
+                        ]
+                    };
+                }
+            },
+        }
+
+        if (config.jwtAuthEnabled && config.jwtAuthEnabled === "true") {
+            s3CheckTagsAndDelete.options = {
+                auth: jwtAuthStrategyName
+            }
+        }
+
+        server.route(s3CheckTagsAndDelete);
+
         const deleteOptions: any = {
             method: "DELETE",
             path: "/s3/{id}/{pageKey}/{componentKey}/delete-file-by-key",
             handler: async (request: HapiRequest, h: HapiResponseToolkit) => {
-                const {query} = request;
-                const {s3UploadService, adapterCacheService} = request.services([]);
-                //@ts-ignore
-                const state = await adapterCacheService.getState(request);
-                let form_session_identifier = state.metadata?.form_session_identifier ?? "";
-                if (query.form_session_identifier) {
-                    form_session_identifier = query.form_session_identifier;
-                }
-                if (!form_session_identifier) {
-                    return h.response({ok: false}).code(401);
-                }
-                const {id, pageKey, componentKey} = request.params as any;
+                const {
+                    //@ts-ignore
+                    s3UploadService, form_session_identifier, id, pageKey, componentKey
+                } = await this.extractRequestData(request, h);
                 //@ts-ignore
                 const {filename} = request.payload;
 
@@ -126,4 +147,28 @@ export class RegisterS3FileUploadApi implements RegisterApi {
         server.route(deleteOptions);
 
     }
+
+    private async extractRequestData(request: HapiRequest, h: HapiResponseToolkit) {
+        const {query} = request;
+        const {s3UploadService, adapterCacheService} = request.services([]);
+        //@ts-ignore
+        const state = await adapterCacheService.getState(request);
+        let form_session_identifier = state.metadata?.form_session_identifier ?? "";
+        if (query.form_session_identifier) {
+            form_session_identifier = query.form_session_identifier;
+        }
+        if (!form_session_identifier) {
+            return h.response({ok: false}).code(401);
+        }
+        const {id, pageKey, componentKey} = request.params as any;
+
+        return {
+            s3UploadService,
+            adapterCacheService,
+            form_session_identifier,
+            id,
+            pageKey,
+            componentKey
+        };
+    }
 }
diff --git a/runner/src/server/plugins/engine/views/components/clientsidefileuploadfield.html b/runner/src/server/plugins/engine/views/components/clientsidefileuploadfield.html
diff --git a/runner/src/server/services/S3UploadService.ts b/runner/src/server/services/S3UploadService.ts

Original file line number	Diff line number	Diff line change
`@@ -69,5 +69,6 @@`
`69`	`69`	`"ignoreSectionsFromSummary": "IGNORE_SECTIONS_FROM_SUMMARY_PAGE",`
`70`	`70`	`"sentryDsn": "SENTRY_DSN",`
`71`	`71`	`"sentryTracesSampleRate": "SENTRY_TRACES_SAMPLE_RATE",`
`72`		`- "copilotEnv": "COPILOT_ENV"`
	`72`	`+ "copilotEnv": "COPILOT_ENV",`
	`73`	`+ "enableVirusScan": "ENABLE_VIRUS_SCAN"`
`73`	`74`	`}`