Method scanFileIfEnabled

src/FileRise/Domain/UploadModel.php:1436–1489

* Optionally scan an uploaded file with ClamAV. * * $context may include the same keys as scanSingleUploadIfEnabled(). * * Returns: * - null => scanning disabled or file clean * - ['error' => …] => infected or scan error (file is deleted) */

(string $path, array $context = [])

     *   - ['error' => …] => infected or scan error (file is deleted)
     */
    private static function scanFileIfEnabled(string $path, array $context = []): ?array
    {
        // Respect env override + admin setting
        if (!self::isVirusScanEnabled()) {
            return null; // scanning disabled
        }

        if (!is_file($path)) {
            return ['error' => 'Virus scan failed: uploaded file not found.'];
        }

        if (self::isVirusScanExcluded($context)) {
            return null; // excluded path
        }

        if (!WorkerLauncher::canRunForeground()) {
            error_log('ClamAV scan skipped: PHP command execution is unavailable on this host.');
            return null;
        }

        $cmd = defined('VIRUS_SCAN_CMD') ? VIRUS_SCAN_CMD : 'clamscan';

        $cmdline = escapeshellcmd($cmd)
            . ' --stdout --no-summary '
            . escapeshellarg($path)
            . ' 2>&1';

        $output   = [];
        $exitCode = 0;
        @exec($cmdline, $output, $exitCode);
        $msg = trim(implode("\n", $output));

        // 0 = clean
        if ($exitCode === 0) {
            return null;
        }

        // 1 = virus found → block + delete + log
        if ($exitCode === 1) {
            // Allow self-test endpoints to suppress log if they pass suppressLog=true
            if (empty($context['suppressLog'])) {
                self::logVirusDetection($path, $msg, $context, $cmd, $exitCode);
            }
            @unlink($path);
            return [
                'error' => 'Upload blocked: virus detected in file.',
            ];
        }

        // >1 = scanner error (missing DB, bad config, etc.)
        // Log but do NOT block the upload.
        error_log("ClamAV scan error (exit={$exitCode}, cmd={$cmd}): {$msg}");
        return null;
    }

    /**
     * Recursively removes a directory and its contents.