Scan a file

Downloads a file from a signed URL and runs some security checks, returning the result of each check. The response reports the outcome of three independent checks:

1. Malware scan (malware) — The file is scanned for malware with Amazon GuardDuty Malware Protection. The endpoint polls the object's scan status tag and returns NO_THREATS_FOUND when the file is clean, THREATS_FOUND when malware is detected, or ERROR when the scan status could not be determined (for example the scan did not complete within the polling window).

2. Unicode smuggling (unicode_smuggling) — The bytes of the content are inspected for unicode smuggling (unicode tag block characters, bidirectional overrides, and zero-width characters). The field is false when the file is clean and true when suspicious characters are found.

3. Extension / content mismatch (extension_mismatch) — The actual MIME type is detected from the file's magic bytes and compared against the file extension. The field is false when the content matches the extension and true otherwise.

Limitations

• File size — The file is downloaded into memory, so uploads are capped at 50 MB. A larger file (or one that cannot be downloaded from the download_url) results in a 400 response.
• Malware scan timeout — GuardDuty is polled roughly once per second for up to ~25 seconds. If the scan has not completed within that window, malware is returned as ERROR and the other two checks are still reported.
• Unicode smuggling scan window — Only the file name and the first 100 KB of the content are inspected. Smuggling characters located beyond the first 100 KB are not detected.
• Supported file types (extension/content check) — Only csv, txt, pdf, docx, and xlsx are recognised. A file whose extension is outside this set is reported as extension_mismatch: true. txt and csv have no magic bytes and are treated as a match when no MIME type can be detected from the content.

curl -X POST "https://tools.dev.files.haufe.io/v1/scan" \  -H "Content-Type: application/json" \  -d '{    "download_url": "https://example-bucket.s3.eu-central-1.amazonaws.com/uploads/report.pdf?X-Amz-Signature=..."  }'

{
  "clean": true,
  "checks": {
    "malware": "NO_THREATS_FOUND",
    "unicode_smuggling": false,
    "extension_mismatch": false
  }
}

{
  "message": "Validation error: download_url is required"
}

{
  "message": "Invalid API Key"
}

{
  "message": "Internal Server Error"
}