Antivirus Scan of File Upload

Purpose

The antivirus scan of uploaded files helps protect Spider Business Center from malicious or unsafe files submitted through the user interface or API. Before an uploaded file is accepted for further processing or stored by the system, it is validated and scanned by external antivirus software. This reduces the risk of malware entering the application through file-based workflows while keeping the upload experience transparent for end users.

How it works

The implementation follows a staged scan-and-release approach. Uploaded files are not accepted immediately. Instead, they pass through a controlled scanning process and are only released for normal application use after the scan result is known.

The user or client uploads a file to SBC.
SBC performs initial validation, such as file size checks and extension checks.
The file is placed into a temporary staging area for scanning.
A background scanning bridge passes the file to a configured antivirus scanner.
Based on the scanner result, the file is either accepted as clean or isolated as unsafe.
Only clean files continue into the normal application flow.

If the file is clean

The upload continues normally. The application can then persist the file and related metadata.

If the file is unsafe or scanning fails

The upload is rejected. Unsafe files are quarantined, and the user receives an error response instead of a successful upload.

Customer-facing behavior

For end users, the feature is straightforward:

safe files upload successfully,
infected or prohibited files are rejected,
the application does not continue processing a file until the scan outcome is known, and
files that fail scanning do not silently enter normal storage.

This means customers gain an additional security control without changing the normal business process for valid uploads.

What is configured

The feature is configurable so that it can fit different customer environments and operating models. SBC can be connected to an external scanner through its command-line interface, and the file-scanning module controls how files move through the staging process.

Typical configuration areas include the following:

whether scanning is enabled,
which scanner bridge is used,
the folder locations for staged, clean, and quarantined files,
timeout and polling behavior,
maximum allowed upload size,
allowed and blocked file extensions, and
scanner-specific command settings such as executable path, arguments, and expected exit codes.

If scanning is intentionally disabled for a deployment, that decision should be explicit and controlled, because uploads are then accepted without antivirus verification.

Configuration guidance

Configuration is typically done during installation or deployment rather than in everyday business use. You should make sure that:

an antivirus product is available and supported in the target environment,
the antivirus product support a command line interface (CLI),
the scanner can be executed by the SBC runtime account,
the configured staging folders are valid and accessible,
scanner-specific settings are tested in the real service context, and
operational procedures for quarantine handling and alerting are defined.

The SBC Configuration Tool provides pre-defined configurations for the following antivirus products:

Microsoft Windows Defender
ClamAV

Any other antivirus product can be used as long as it fulfills the above conditions. The proper configuration is up to you. Leica Geosystems does not provide support on the configuration of the third-party antivirus products.

If you want to share your experience with other antivirus products with the worldwide Leica Spider community, this is very welcome. Please provide the description to us via your local Leica Geosystems distribution partner so this help page can be extended.

How it is configured

Parameters for configuring the file-upload scan can be stored in and are read from different locations. These are in the following priority order:

Azure Key Vault
operating system environment variables
appsettings.json file of the SBC Central Server

The following parameters can be adapted to steer the behaviour of the file scanning in general:

Parameter	Description
FileScanning:Enabled	Switches the antivirus scan of uploaded files on or off. When it is off, uploads are accepted without being scanned. Switching it off on a production system additionally requires FileScanning:AllowDisabledInProduction. Default: true
FileScanning:DirtyFolderPath	Folder for files waiting to be scanned.
FileScanning:CleanFolderPath	Folder for successfully scanned safe files
FileScanning:QuarantineFolderPath	Folder for infected files.
FileScanning:ScanTimeoutSeconds	Max. waiting time per file in the attribute poll loop and per scanner process in the bridge. Default: 300 s
FileScanning:PollingIntervalMs	How often the attribute checks for the scan result. Default: 1000 ms
FileScanning:DeleteQuarantinedFiles	Auto-delete from quarantine.
FileScanning:MaxFileSizeBytes	Enforced by the attribute before the file is written to disk. Default: 104857600 (equals to 100 MB)
FileScanning:AllowedExtensions	Comma-separated whitelist. Default: ““ (empty = allow all (subject to blocked list)).
FileScanning:BlockedExtensions	Comma-separated blocklist. Checked against all extension segments (double-extension attack defence). Default: “.exe,.dll,.bat,.cmd,.vbs,.ps1,.sh”
FileScanning:ScannerBridge	Selects how the SBC Central Server connects to the antivirus scanner. This is not the scanner itself: it selects the integration method, while ScannerCommand:Executable names the program that is run. Options are: Command: scan with a command-line antivirus product. This is the only method available today and the one all pre-defined scanner configurations use. The ScannerCommand:* parameters are only read with this setting. Empty: no scanner is connected. This is only permitted together with FileScanning:Enabled=false and FileScanning:AllowDisabledInProduction=true. Default: empty
FileScanning:MaxConcurrentScans	Bridge-side semaphore. Limits simultaneous scanner processes. Default: 4

The following parameters need to be adapted depending on the utilised antivirus scanner:

Parameter	Description
ScannerCommand:Executable	Full path (or name on PATH) of the scanner executable. It must be set when FileScanning:ScannerBridge=Command
ScannerCommand:Arguments	Arguments passed to the executable. Use {file} for the full host path (quoted), or {filename} for the filename only - useful when the scanner runs inside a container with the dirty folder bind-mounted at a fixed path. Default: {file}
ScannerCommand:CleanExitCode	Exit code that means the file is clean. Default: 0
ScannerCommand:InfectedExitCodes	Exit codes that mean the file is infected. Any non-clean exit code not in this list is treated as a scanner error and leaves the file in the dirty folder. Default: [1, 2] (ClamAV = 1, Windows Defender = 2)
ScannerCommand:ScanErrorOutputPattern	Regex matched (case-insensitively) against the scanner’s combined stdout/stderr, ahead of the exit code. A match means the scanner reported a failed run, so the exit code carries no verdict and the scan is treated as a scanner error. Required for scanners whose exit codes are ambiguous. E.g., Windows Defender returns 2 for a detection and for its own failures, so it needs CmdTool:\s*Failed with hr or every clean upload on a host where Defender cannot run is rejected as malware. The output is flattened to a single line before matching (all whitespace runs, newlines included, collapse to one space), so keep the pattern unanchored and substring-shaped - an anchored or \n-containing pattern silently never matches and classification falls back to the exit code. Empty classifies on the exit code alone. An invalid expression prevents startup. Default: ""
ScannerCommand:Version	Human-readable scanner version string stored on UploadedFile.ScannerVersion for audit purposes (e.g. "ClamAV 1.3.2"). Default: "unknown"

Configuration Examples

The configurations of the third-party antivirus products shown in this section are examples. They were working at the time this documentation was created. As changes of these products are possible at any time and are not in the control of Leica Geosystems, the necessary configuration can change at any time.

If you want to share your experience with these or other antivirus products with the worldwide Leica Spider community, this is very welcome. Please provide the description to us via your local Leica Geosystems distribution partner so this help page can be extended.

Microsoft Windows Defender

The example configuration for the Microsoft Windows Defender looks like:

Parameter	Value
ScannerCommand:Executable	"C:\\Program Files\\Windows Defender\\MpCmdRun.exe"
ScannerCommand:Arguments	"-Scan -ScanType 3 -File {file} -DisableRemediation"
ScannerCommand:CleanExitCode	0
ScannerCommand:InfectedExitCodes	2
ScannerCommand:ScanErrorOutputPattern	"CmdTool:\\s*Failed with hr"
ScannerCommand:Version	"Window Defender"

Applies to: Windows Defender 4.18.2104.5 on Windows Server 2022

ClamAV

The example configuration for the ClamAV looks like:

Parameter	Value
ScannerCommand:Executable	"clamdscan"
ScannerCommand:Arguments	"--no-summary {file}"
ScannerCommand:CleanExitCode	0
ScannerCommand:InfectedExitCodes
ScannerCommand:ScanErrorOutputPattern	""
ScannerCommand:Version	""

FAQ

Does SBC scan every uploaded file?

Yes, when the feature is enabled, uploaded files pass through validation and scanning before they are accepted.

What happens if malware is detected?

The upload is rejected and the file is isolated in quarantine instead of being accepted into normal processing.

Can customers use different antivirus products?

Yes. The implementation is designed to work with an external scanner through configurable command execution, provided that the scanner can be reached from the SBC runtime environment.

Is this only for the user interface?

No. The protection applies to upload functionality exposed through both UI and API entry points where the feature is integrated.