files_antivirus icon indicating copy to clipboard operation
files_antivirus copied to clipboard
verified publisher icon nextcloud

Files larger than 10MB aren't scanned nextcloud 14

Open Xoeseko opened this issue 6 years ago • 1 comments

Steps to reproduce

  1. Upload an archive containing EICAR test file to nextcloud. (larger than 10MB)
  2. Watch the upload complete successfully without a single byte of data being sent to the clamav daemon

Expected behaviour

The plugin should send the files to the daemon as usual. And output Virus Txt.Ransomware.Eicar-2 is detected in the file. Upload cannot be completed. as it does with later versions of nextcloud.

Actual behaviour

Nothing is logged or deleted and the file is simply uploaded as if nothing was wrong. The daemon doesn't even receive a scan command.

Server configuration

Operating system: Independent discovered on CentOS 7 also in official nextcloud:14 docker image

Web server: Apache/2.4.6 (CentOS) Apache/2.4.38 (Debian) (Docker)

Database: mysql on server sqlite3 locally through docker

PHP version: 7.0.33 and 7.2.21(docker)

Nextcloud version: (see Nextcloud admin page) 14.0.4 and 14.0.13(docker) Where did you install Nextcloud from: Installed from source cloned from the github repository a few months ago and nextcloud/docker official apache image

List of activated apps: Server:

Enabled:
  - accessibility: 1.0.1
  - activity: 2.7.0
  - cloud_federation_api: 0.0.1
  - comments: 1.4.0
  - dav: 1.6.0
  - federatedfilesharing: 1.4.0
  - federation: 1.4.0
  - files: 1.9.0
  - files_antivirus: 1.4.2
  - files_pdfviewer: 1.3.2
  - files_sharing: 1.6.2
  - files_texteditor: 2.6.0
  - files_trashbin: 1.4.1
  - files_versions: 1.7.1
  - files_videoplayer: 1.3.0
  - firstrunwizard: 2.3.0
  - gallery: 18.1.0
  - logreader: 2.0.0
  - lookup_server_connector: 1.2.0
  - nextcloud_announcements: 1.3.0
  - notifications: 2.2.1
  - oauth2: 1.2.1
  - password_policy: 1.4.0
  - provisioning_api: 1.4.0
  - serverinfo: 1.4.0
  - sharebymail: 1.4.0
  - support: 1.0.0
  - survey_client: 1.2.0
  - systemtags: 1.4.0
  - theming: 1.5.0
  - twofactor_backupcodes: 1.3.1
  - updatenotification: 1.4.1
  - user_ldap: 1.4.0
  - workflowengine: 1.4.0
Disabled:
  - admin_audit
  - encryption
  - files_external
  - user_external

Docker:

Enabled:
  - accessibility: 1.0.1
  - activity: 2.7.0
  - cloud_federation_api: 0.0.1
  - comments: 1.4.0
  - dav: 1.6.1
  - federatedfilesharing: 1.4.0
  - federation: 1.4.0
  - files: 1.9.0
  - files_antivirus: 1.4.2
  - files_pdfviewer: 1.3.2
  - files_sharing: 1.6.2
  - files_texteditor: 2.6.0
  - files_trashbin: 1.4.1
  - files_versions: 1.7.1
  - files_videoplayer: 1.3.0
  - firstrunwizard: 2.3.0
  - gallery: 18.1.0
  - logreader: 2.0.0
  - lookup_server_connector: 1.2.0
  - nextcloud_announcements: 1.3.0
  - notifications: 2.2.1
  - oauth2: 1.2.1
  - password_policy: 1.4.0
  - provisioning_api: 1.4.0
  - serverinfo: 1.4.0
  - sharebymail: 1.4.0
  - support: 1.0.0
  - survey_client: 1.2.0
  - systemtags: 1.4.0
  - theming: 1.5.0
  - twofactor_backupcodes: 1.3.1
  - updatenotification: 1.4.1
  - workflowengine: 1.4.0
Disabled:
  - admin_audit
  - encryption
  - files_external
  - user_external
  - user_ldap

Nextcloud configuration:

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost:8080"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "sqlite3",
        "version": "14.0.13.1",
        "overwrite.cli.url": "http:\/\/localhost:8080",
        "installed": true
    }
}

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "version": "14.0.4.2",
        "dbtype": "mysql",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "installed": true,
        "default_language": "en",
        "defaultapp": "files",
        "knowledgebaseenabled": true,
        "enable_avatars": true,
        "allow_user_to_change_display_name": true,
        "remember_login_cookie_lifetime": 1296000,
        "session_lifetime": 86400,
        "session_keepalive": true,
        "skeletondirectory": "\/var\/www\/html\/nextcloud\/core\/skeleton",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpdebug": false,
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_smtptimeout": 10,
        "overwritehost": "",
        "overwriteprotocol": "",
        "overwritewebroot": "",
        "overwritecondaddr": "",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "proxy": "***REMOVED SENSITIVE VALUE***",
        "proxyuserpwd": "***REMOVED SENSITIVE VALUE***",
        "trashbin_retention_obligation": "auto, auto",
        "versions_retention_obligation": "auto",
        "appcodechecker": true,
        "updatechecker": true,
        "has_internet_connection": true,
        "check_for_working_webdav": true,
        "check_for_working_htaccess": true,
        "config_is_read_only": false,
        "log_type": "owncloud",
        "logfile": "\/var\/www\/html\/nextcloud\/log\/nextcloud.log",
        "loglevel": 3,
        "syslog_tag": "nextCloud",
        "log.condition": {
            "shared_secret": "***REMOVED SENSITIVE VALUE***",
            "users": [
                "sample-user"
            ],
            "apps": [
                "files"
            ]
        },
        "logdateformat": "F d, Y H:i:s",
        "logtimezone": "Europe\/Zurich",
        "log_query": false,
        "cron_log": true,
        "cron.lockfile.location": "",
        "log_rotate_size": false,
        "3rdpartyroot": "",
        "3rdpartyurl": "",
        "customclient_desktop": "https:\/\/nextcloud.com\/install\/",
        "customclient_android": "https:\/\/play.google.com\/store\/apps\/details?id=com.nextcloud.client",
        "customclient_ios": "https:\/\/itunes.apple.com\/us\/app\/nextcloud\/id1125420102?mt=8",
        "appstoreenabled": true,
        "appstore.experimental.enabled": false,
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/nextcloud\/apps",
                "url": "\/apps",
                "writable": true
            }
        ],
        "enable_previews": true,
        "preview_max_x": 2048,
        "preview_max_y": 2048,
        "preview_max_scale_factor": 10,
        "preview_max_filesize_image": 50,
        "preview_libreoffice_path": "\/usr\/bin\/libreoffice",
        "preview_office_cl_parameters": " --headless --nologo --nofirststartwizard --invisible --norestore -convert-to pdf -outdir ",
        "enabledPreviewProviders": [
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\MP3",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown"
        ],
        "ldapUserCleanupInterval": 51,
        "enforce_home_folder_naming_rule": true,
        "maintenance": false,
        "singleuser": false,
        "openssl": {
            "config": "\/absolute\/location\/of\/openssl.cnf"
        },
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0,
            "password": "***REMOVED SENSITIVE VALUE***",
            "dbindex": 0
        },
        "memcached_servers": [
            [
                "localhost",
                11211
            ]
        ],
        "cache_path": "",
        "sqlite.journal_mode": "DELETE",
        "supportedDatabases": [
            "sqlite",
            "mysql",
            "pgsql",
            "oci"
        ],
        "tempdirectory": "\/var\/www\/html\/nextcloud\/tmp",
        "hashingCost": 10,
        "blacklisted_files": [
            ".htaccess"
        ],
        "share_folder": "\/",
        "theme": "",
        "cipher": "AES-256-CFB",
        "minimum.supported.desktop.version": "1.7.0",
        "quota_include_external_storage": false,
        "filesystem_check_changes": 0,
        "asset-pipeline.enabled": false,
        "assetdirectory": "\/var\/www\/nextcloud",
        "mount_file": "\/var\/www\/html\/nextcloud\/data\/mount.json",
        "filesystem_cache_readonly": false,
        "secret": "***REMOVED SENSITIVE VALUE***",
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED",
            "HTTP_FORWARDED_FOR"
        ],
        "max_filesize_animated_gifs_public_sharing": 10,
        "filelocking.enabled": true,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "debug": false,
        "copied_sample_config": false,
        "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
        "updater.release.channel": "production",
        "ldapIgnoreNamingRules": false,
        "data-fingerprint": "c565b7bad2f19b0d4ae759b492c77673"
    }
}

Client configuration

Browser: Chrome and firefox tested

Operating system:

Logs

Nothing is logged...

Nextcloud log (data/owncloud.log)

{"reqId":"1npD0TM0sHrj1q2hv6zD","level":2,"time":"2019-08-06T12:03:08+00:00","remoteAddr":"172.17.0.1","user":"xoesekoadm","app":"files_antivirus","method":"PUT","url":"\/remote.php\/webdav\/test9MB.zip","message":"Infected file deleted. Txt.Ransomware.Eicar-2 Account: xoesekoadm Path: files\/test9MB.zip.ocTransferId713406523.part","userAgent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36","version":"14.0.13.1"}                                                                                                                                                                                                                             {"reqId":"1npD0TM0sHrj1q2hv6zD","level":3,"time":"2019-08-06T12:03:08+00:00","remoteAddr":"172.17.0.1","user":"xoesekoadm","app":"files_antivirus","method":"PUT","url":"\/remote.php\/webdav\/test9MB.zip","message":"Infected file deleted. Txt.Ransomware.Eicar-2 File: files\/test9MB.zip.ocTransferId713406523.part Account: xoesekoadm","userAgent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36","version":"14.0.13.1"}                                                                                                                                                                                                                             {"reqId":"1npD0TM0sHrj1q2hv6zD","level":3,"time":"2019-08-06T12:03:08+00:00","remoteAddr":"172.17.0.1","user":"xoesekoadm","app":"no app in context","method":"PUT","url":"\/remote.php\/webdav\/test9MB.zip","message":{"Exception":"OCP\\Files\\InvalidContentException","Message":"Virus Txt.Ransomware.Eicar-2 is detected in the file. Upload cannot be completed.","Code":0,"Trace":[{"function":"OCA\\Files_Antivirus\\{closure}","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"\/var\/www\/html\/3rdparty\/icewind\/streams\/src\/CallbackWrapper.php","line":109,"function":"call_user_func","args":[{"__class__":"Closure"}]},{"function":"stream_close","class":"Icewind\\Streams\\CallbackWrapper","type":"->","args":[]},{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/File.php","line":175,"function":"fclose","args":[null]},{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/Directory.php","line":156,"function":"put","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":1096,"function":"createFile","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["test9MB.zip",null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/CorePlugin.php","line":525,"function":"createFile","class":"Sabre\\DAV\\Server","type":"->","args":["test9MB.zip",null,null]},{"function":"httpPut","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/event\/lib\/EventEmitterTrait.php","line":105,"function":"call_user_func_array","args":[[{"__class__":"Sabre\\DAV\\CorePlugin"},"httpPut"],[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":479,"function":"emit","class":"Sabre\\Event\\EventEmitter","type":"->","args":["method:PUT",[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":254,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php","line":80,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"\/var\/www\/html\/remote.php","line":163,"args":["\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php"],"function":"require_once"}],"File":"\/var\/www\/html\/custom_apps\/files_antivirus\/lib\/AvirWrapper.php","Line":137,"CustomMessage":"--"},"userAgent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36","version":"14.0.13.1"}                                                                                                                              {"reqId":"1npD0TM0sHrj1q2hv6zD","level":4,"time":"2019-08-06T12:03:08+00:00","remoteAddr":"172.17.0.1","user":"xoesekoadm","app":"webdav","method":"PUT","url":"\/remote.php\/webdav\/test9MB.zip","message":{"Exception":"OCA\\DAV\\Connector\\Sabre\\Exception\\UnsupportedMediaType","Message":"Virus Txt.Ransomware.Eicar-2 is detected in the file. Upload cannot be completed.","Code":0,"Trace":[{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/File.php","line":200,"function":"convertToSabreException","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[{"__class__":"OCP\\Files\\InvalidContentException"}]},{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/Directory.php","line":156,"function":"put","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":1096,"function":"createFile","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["test9MB.zip",null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/CorePlugin.php","line":525,"function":"createFile","class":"Sabre\\DAV\\Server","type":"->","args":["test9MB.zip",null,null]},{"function":"httpPut","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/event\/lib\/EventEmitterTrait.php","line":105,"function":"call_user_func_array","args":[[{"__class__":"Sabre\\DAV\\CorePlugin"},"httpPut"],[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":479,"function":"emit","class":"Sabre\\Event\\EventEmitter","type":"->","args":["method:PUT",[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":254,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php","line":80,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"\/var\/www\/html\/remote.php","line":163,"args":["\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php"],"function":"require_once"}],"File":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/File.php","Line":569,"Previous":{"Exception":"OCP\\Files\\InvalidContentException","Message":"Virus Txt.Ransomware.Eicar-2 is detected in the file. Upload cannot be completed.","Code":0,"Trace":[{"function":"OCA\\Files_Antivirus\\{closure}","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"\/var\/www\/html\/3rdparty\/icewind\/streams\/src\/CallbackWrapper.php","line":109,"function":"call_user_func","args":[{"__class__":"Closure"}]},{"function":"stream_close","class":"Icewind\\Streams\\CallbackWrapper","type":"->","args":[]},{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/File.php","line":175,"function":"fclose","args":[null]},{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/Directory.php","line":156,"function":"put","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":1096,"function":"createFile","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["test9MB.zip",null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/CorePlugin.php","line":525,"function":"createFile","class":"Sabre\\DAV\\Server","type":"->","args":["test9MB.zip",null,null]},{"function":"httpPut","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/event\/lib\/EventEmitterTrait.php","line":105,"function":"call_user_func_array","args":[[{"__class__":"Sabre\\DAV\\CorePlugin"},"httpPut"],[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":479,"function":"emit","class":"Sabre\\Event\\EventEmitter","type":"->","args":["method:PUT",[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":254,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php","line":80,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"\/var\/www\/html\/remote.php","line":163,"args":["\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php"],"function":"require_once"}],"File":"\/var\/www\/html\/custom_apps\/files_antivirus\/lib\/AvirWrapper.php","Line":137},"CustomMessage":"--"},"userAgent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36","version":"14.0.13.1"}
{"reqId":"TQ5Q5qfxsjuQr8j8bY3X","level":2,"time":"2019-08-06T12:32:34+00:00","remoteAddr":"172.17.0.1","user":"xoesekoadm","app":"files_antivirus","method":"PUT","url":"\/remote.php\/webdav\/test9MB.zip","message":"Infected file deleted. Txt.Ransomware.Eicar-2 Account: xoesekoadm Path: files\/test9MB.zip.ocTransferId1167960095.part","userAgent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36","version":"14.0.13.1"}
{"reqId":"TQ5Q5qfxsjuQr8j8bY3X","level":3,"time":"2019-08-06T12:32:34+00:00","remoteAddr":"172.17.0.1","user":"xoesekoadm","app":"files_antivirus","method":"PUT","url":"\/remote.php\/webdav\/test9MB.zip","message":"Infected file deleted. Txt.Ransomware.Eicar-2 File: files\/test9MB.zip.ocTransferId1167960095.part Account: xoesekoadm","userAgent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36","version":"14.0.13.1"}
{"reqId":"TQ5Q5qfxsjuQr8j8bY3X","level":3,"time":"2019-08-06T12:32:34+00:00","remoteAddr":"172.17.0.1","user":"xoesekoadm","app":"no app in context","method":"PUT","url":"\/remote.php\/webdav\/test9MB.zip","message":{"Exception":"OCP\\Files\\InvalidContentException","Message":"Virus Txt.Ransomware.Eicar-2 is detected in the file. Upload cannot be completed.","Code":0,"Trace":[{"function":"OCA\\Files_Antivirus\\{closure}","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"\/var\/www\/html\/3rdparty\/icewind\/streams\/src\/CallbackWrapper.php","line":109,"function":"call_user_func","args":[{"__class__":"Closure"}]},{"function":"stream_close","class":"Icewind\\Streams\\CallbackWrapper","type":"->","args":[]},{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/File.php","line":175,"function":"fclose","args":[null]},{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/Directory.php","line":156,"function":"put","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":1096,"function":"createFile","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["test9MB.zip",null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/CorePlugin.php","line":525,"function":"createFile","class":"Sabre\\DAV\\Server","type":"->","args":["test9MB.zip",null,null]},{"function":"httpPut","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/event\/lib\/EventEmitterTrait.php","line":105,"function":"call_user_func_array","args":[[{"__class__":"Sabre\\DAV\\CorePlugin"},"httpPut"],[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":479,"function":"emit","class":"Sabre\\Event\\EventEmitter","type":"->","args":["method:PUT",[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":254,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php","line":80,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"\/var\/www\/html\/remote.php","line":163,"args":["\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php"],"function":"require_once"}],"File":"\/var\/www\/html\/custom_apps\/files_antivirus\/lib\/AvirWrapper.php","Line":137,"CustomMessage":"--"},"userAgent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36","version":"14.0.13.1"}
{"reqId":"TQ5Q5qfxsjuQr8j8bY3X","level":4,"time":"2019-08-06T12:32:34+00:00","remoteAddr":"172.17.0.1","user":"xoesekoadm","app":"webdav","method":"PUT","url":"\/remote.php\/webdav\/test9MB.zip","message":{"Exception":"OCA\\DAV\\Connector\\Sabre\\Exception\\UnsupportedMediaType","Message":"Virus Txt.Ransomware.Eicar-2 is detected in the file. Upload cannot be completed.","Code":0,"Trace":[{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/File.php","line":200,"function":"convertToSabreException","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[{"__class__":"OCP\\Files\\InvalidContentException"}]},{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/Directory.php","line":156,"function":"put","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":1096,"function":"createFile","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["test9MB.zip",null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/CorePlugin.php","line":525,"function":"createFile","class":"Sabre\\DAV\\Server","type":"->","args":["test9MB.zip",null,null]},{"function":"httpPut","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/event\/lib\/EventEmitterTrait.php","line":105,"function":"call_user_func_array","args":[[{"__class__":"Sabre\\DAV\\CorePlugin"},"httpPut"],[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":479,"function":"emit","class":"Sabre\\Event\\EventEmitter","type":"->","args":["method:PUT",[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":254,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php","line":80,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"\/var\/www\/html\/remote.php","line":163,"args":["\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php"],"function":"require_once"}],"File":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/File.php","Line":569,"Previous":{"Exception":"OCP\\Files\\InvalidContentException","Message":"Virus Txt.Ransomware.Eicar-2 is detected in the file. Upload cannot be completed.","Code":0,"Trace":[{"function":"OCA\\Files_Antivirus\\{closure}","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"\/var\/www\/html\/3rdparty\/icewind\/streams\/src\/CallbackWrapper.php","line":109,"function":"call_user_func","args":[{"__class__":"Closure"}]},{"function":"stream_close","class":"Icewind\\Streams\\CallbackWrapper","type":"->","args":[]},{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/File.php","line":175,"function":"fclose","args":[null]},{"file":"\/var\/www\/html\/apps\/dav\/lib\/Connector\/Sabre\/Directory.php","line":156,"function":"put","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":1096,"function":"createFile","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["test9MB.zip",null]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/CorePlugin.php","line":525,"function":"createFile","class":"Sabre\\DAV\\Server","type":"->","args":["test9MB.zip",null,null]},{"function":"httpPut","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/event\/lib\/EventEmitterTrait.php","line":105,"function":"call_user_func_array","args":[[{"__class__":"Sabre\\DAV\\CorePlugin"},"httpPut"],[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":479,"function":"emit","class":"Sabre\\Event\\EventEmitter","type":"->","args":["method:PUT",[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"\/var\/www\/html\/3rdparty\/sabre\/dav\/lib\/DAV\/Server.php","line":254,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"absoluteUrl":"http:\/\/localhost:8080\/remote.php\/webdav\/test9MB.zip","__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php","line":80,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"\/var\/www\/html\/remote.php","line":163,"args":["\/var\/www\/html\/apps\/dav\/appinfo\/v1\/webdav.php"],"function":"require_once"}],"File":"\/var\/www\/html\/custom_apps\/files_antivirus\/lib\/AvirWrapper.php","Line":137},"CustomMessage":"--"},"userAgent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko\/20100101 Firefox\/68.0","version":"14.0.13.1"}

The test archives are named after their sizes and nothing is logged for the mutliple test archives that were over 10MB.

Browser log

Insert your browser log here, this could for example include:

a) The javascript console log Empty on error b) The network log

<?xml version="1.0"?>
<d:multistatus xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns" xmlns:oc="http://owncloud.org/ns" xmlns:nc="http://nextcloud.org/ns"><d:response><d:href>/remote.php/dav/files/xoesekoadm/test10MB.zip</d:href><d:propstat><d:prop><d:getlastmodified>Mon, 05 Aug 2019 11:28:46 GMT</d:getlastmodified><d:getetag>&quot;d7fe765e2621d9d4ac33616d43633e69&quot;</d:getetag><d:getcontenttype>application/zip</d:getcontenttype><d:resourcetype/><oc:fileid>280</oc:fileid><oc:permissions>RGDNVW</oc:permissions><oc:size>10664344</oc:size><d:getcontentlength>10664344</d:getcontentlength><nc:has-preview>false</nc:has-preview><nc:mount-type></nc:mount-type><x1:share-permissions xmlns:x1="http://open-collaboration-services.org/ns">19</x1:share-permissions><oc:tags/><oc:favorite>0</oc:favorite><oc:comments-unread>0</oc:comments-unread><oc:owner-id>xoesekoadm</oc:owner-id><oc:owner-display-name>xoesekoadm</oc:owner-display-name><oc:share-types/></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat><d:propstat><d:prop><nc:is-encrypted/></d:prop><d:status>HTTP/1.1 404 Not Found</d:status></d:propstat></d:response></d:multistatus>

Xoeseko avatar Aug 06 '19 13:08 Xoeseko

👍

jbstand avatar Aug 06 '19 15:08 jbstand