I am building a small web app in php, that accepts .doc /.docx / .rtf and .txt files. I've validated them against their mime-types. But now I'm thinking about virus scanning. I know there are systems like siteLock that can scan your systems for malware/viruses. I also know there are http://en.wikipedia.org/wiki/Clam_AntiVirus that I believe can be used to scan the stream as it's uploaded.

Is it necessary to also try and use Clam as the stream is uploaded? Not really sure here what is the best way forward?

Thanks for any help. My first post on here.

  • 'Validation Filters' are often quite thin. Making stuff look like other stuff is often possible; A B C
    – lynks
    Commented Aug 27, 2013 at 16:11
  • There's some question here of what you are trying to accomplish, in re security, with this process. Have you done any threat modeling? It may help answer that question and inform yours.
    – adric
    Commented Aug 28, 2013 at 13:11

3 Answers 3


What do you mean by validating it against it's MIME-type? Mime typing is simply a way for an e-mail to make a claim as to the purpose and type of an attachment. It doesn't include any built in validation. MIME-type has nothing to do with viruses or virus scanning and a virus could still be sent through a Word document macro for example. So no, nothing to do with MIME type precludes the need to virus scan e-mail attachments.


No, the "Content-Type" in the payload or request header can be spoofed, so don't trust it to match the actual type (much like you would not trust the file extension).

It is a good idea to virus scan files as an extra layer of protection but I would say it is more important to store them securely (e.g. writing them as byte data to a database rather than writing them to the file system where it may be possible to remotely execute them using another exploit). Practise defence in depth.


It depends on what your system does. If they're sending the files to you for viewing, then it's always a good idea to scan them for viruses - you don't know what people will have embedded in their files, particularly Word files as they can have dangerous macros. If you're facilitating communication between two unknown people, but not actually viewing the documents yourself (or just storing the documents for later retrieval by the same person) then you don't need to scan for viruses and the best course of action is to (assuming you're using *NIX to host the web app) not set the execute bit on the file permissions, as there's no reason for the files to be executed - you should actually do this for all the documents that are uploaded, regardless of purpose, since there's no reason for document files to be executed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .