How to Block Executable Uploads in Node.JS

Setting up a simple system for detecting various dangerous file extensions is not very difficult, but still leaves you open to “masked” files, which are often renamed to have inoffensive extensions such as PDF or JPG. To properly protect yourself from this type of threat, you will need a specialized means of executable detection. Setting this up on your own is very risky and difficult, as it generally requires a testing sandbox environment and a very thorough approach to be fully effective. Today I will be demonstrating the setup of a Cloudmersive API that can provide full protection against masked executables, as well as triple-layered virus scanning and full zero day threat detection.

To set this up, we will begin with client library installation:

npm install cloudmersive-virus-api-client --save

Now we can call the advanced scan function:

var CloudmersiveVirusApiClient = require('cloudmersive-virus-api-client');var defaultClient = CloudmersiveVirusApiClient.ApiClient.instance;// Configure API key authorization: Apikeyvar Apikey = defaultClient.authentications['Apikey'];Apikey.apiKey = 'YOUR API KEY';// Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)//Apikey.apiKeyPrefix = 'Token';var apiInstance = new CloudmersiveVirusApiClient.ScanApi();var inputFile = "/path/to/file"; // File | Input file to perform the operation on.var opts = {'allowExecutables': true, // Boolean | Set to false to block executable files (program code) from being allowed in the input file.  Default is false (recommended).'allowInvalidFiles': true, // Boolean | Set to false to block invalid files, such as a PDF file that is not really a valid PDF file, or a Word Document that is not a valid Word Document.  Default is false (recommended).'allowScripts': true, // Boolean | Set to false to block script files, such as a PHP files, Pythong scripts, and other malicious content or security threats that can be embedded in the file.  Set to true to allow these file types.  Default is false (recommended).'allowPasswordProtectedFiles': true, // Boolean | Set to false to block password protected and encrypted files, such as encrypted zip and rar files, and other files that seek to circumvent scanning through passwords.  Set to true to allow these file types.  Default is false (recommended).'restrictFileTypes': "restrictFileTypes_example" // String | Specify a restricted set of file formats to allow as clean as a comma-separated list of file formats, such as .pdf,.docx,.png would allow only PDF, PNG and Word document files.  All files must pass content verification against this list of file formats, if they do not, then the result will be returned as CleanResult=false.  Set restrictFileTypes parameter to null or empty string to disable; default is disabled.};var callback = function(error, data, response) {if (error) {console.error(error);} else {console.log('API called successfully. Returned data: ' + data);}};apiInstance.scanFileAdvanced(inputFile, opts, callback);

By default this provides high level protection, with customization available to fit your specific needs.

Image for post
Image for post

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store