# Check File Uploads for Viruses

**URL:** <https://www.ruby-forum.com/t/check-file-uploads-for-viruses/196518>\
**Category:** Rails\
**Created:** [November 16, 2007, 12:11pm UTC](https://www.ruby-forum.com/t/check-file-uploads-for-viruses/196518 "2007-11-16T12:11:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TTDaVeTT](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/91b2a8/32.png) [@TTDaVeTT](https://www.ruby-forum.com/u/TTDaVeTT)\
**Post date:** [November 16, 2007, 12:11pm UTC](https://www.ruby-forum.com/t/check-file-uploads-for-viruses/196518/1 "2007-11-16T12:11:17Z")

</div>

I am currently developing a social networking site using RoR that uses  
the attachment\_fu plugin to handle image uploads. I also want to  
enable users to upload photoshop files, but am worried about security  
vulnerabilities because I want other users to be able to download  
these photoshop files. What is to stop someone from uploading a  
malicious file (i.e. virus) just by changing the extension? I don’t  
want someone downloading a file with a virus on it from my site. Is  
there any way to screen files for viruses when they are uploaded in  
RoR? Any thoughts? Thanks.

---

<div class="post-metadata">

**Author:** ![TTDaVeTT](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/91b2a8/32.png) [@TTDaVeTT](https://www.ruby-forum.com/u/TTDaVeTT)\
**Post date:** [November 16, 2007, 2:51pm UTC](https://www.ruby-forum.com/t/check-file-uploads-for-viruses/196518/2 "2007-11-16T14:51:17Z")

</div>

On 16 Nov 2007, at 12:10, TTDaVeTT wrote:

> I am currently developing a social networking site using RoR that uses  
> the attachment\_fu plugin to handle image uploads. I also want to  
> enable users to upload photoshop files, but am worried about security  
> vulnerabilities because I want other users to be able to download  
> these photoshop files. What is to stop someone from uploading a  
> malicious file (i.e. virus) just by changing the extension? I don’t  
> want someone downloading a file with a virus on it from my site. Is  
> there any way to screen files for viruses when they are uploaded in  
> RoR? Any thoughts? Thanks.

Use the callbacks of attachment\_fu that are executed after the upload  
(my mind’s focussed on other stuff right now, so the exact method  
name doesn’t come to mind) and run the file through ClamAV via the  
´commandline command´ or system ruby calls.

Best regards

Peter De Berdt