Weave Code
Clamav Laravel Package
sineflow/clamav
Laravel integration for ClamAV virus scanning. Scan uploaded files and local paths through clamd using a simple API or validation rule, with configurable Unix socket or TCP connections for reliable malware detection.
ClamAV PHP client
Frequently asked questions about Clamav
- How do I install and configure sineflow/clamav in Laravel?
- Run composer require sineflow/clamav, then publish the package config and set either the Unix socket path or TCP host and port for clamd. You also need a reachable clamd daemon with current signatures in each environment. The package registers a service provider and facade, so no custom bootstrapping is required.
- Does sineflow/clamav include a Laravel validation rule for uploaded files?
- Yes. It provides a Laravel validation rule for infected-file detection, so you can reject bad uploads before storage. You still need a working clamd connection; otherwise validation cannot produce a reliable clean verdict. Treat scan errors separately from infection results in your application.
- Can I scan an S3 file or stream without saving it to disk with sineflow/clamav?
- In v2.1.0, Scanner::scanStream() scans a PHP stream resource using clamd INSTREAM, so you can scan S3 or object storage streams, or php://input, without materializing a file. Verify whether the stream is chunked and whether it is rewound or closed before you reuse it to persist the file after a clean result. It is still a blocking call and subject to daemon StreamMaxLength limits.
- How do I connect sineflow/clamav to clamd using a Unix socket or TCP?
- Publish the config and choose either a Unix socket path for a local clamd or TCP host and port for a remote clamd. The config also covers timeout and scan limits. Keep the daemon reachable from the Laravel runtime and align application upload limits with clamd limits.
- Which Laravel and PHP versions are supported by sineflow/clamav?
- The package is built for Laravel and integrates through a service provider, config, and facade. The exact PHP and Laravel constraints are defined in composer.json, so verify them against your runtime before scheduling work. Do not assume support for a given Laravel major without checking that file and the changelog.
- How do I tell an infected file apart from a ClamAV scan error?
- Do not catch a generic exception and continue with the upload. Own the policy in your adapter: treat an unreachable clamd or scan error as a rejection unless you have a deliberate, documented exception. The package surfaces clear exceptions when malware is detected, but your code must still separate infected from failed-to-scan outcomes.
- What happens when an upload exceeds clamd StreamMaxLength?
- clamd's StreamMaxLength, often 25 MB by default, applies to INSTREAM scanning. scanStream() will surface a clamd error for larger files unless the daemon is tuned. Align your application upload limit with StreamMaxLength and add an explicit size cap before scanning.
- Is sineflow/clamav safe for large uploads and concurrent production traffic?
- It is synchronous and blocking, with no queues, async callbacks, or background scanning. Streaming a very large file to clamd can hold a PHP-FPM worker for minutes, which becomes an availability problem under concurrency. Use a size cap, configure timeouts, and consider a queue path for large objects.
- How can I test ClamAV scanning in Laravel CI without a real daemon?
- You need a real clamd instance for meaningful tests, typically as a container sidecar or CI service with current signatures. Mocking the scanner is fine for unit tests but hides the failure modes that matter, such as unreachable daemons and size-limit errors. Also check whether the package ships a test suite you can run in CI.
- Is sineflow/clamav actively maintained, and what should I consider before relying on it?
- It is a small, single-maintainer OSS package and security-adjacent, so plan for version pinning, changelog review before upgrades, and the option to vendor or fork it. Check license terms and your obligations if you fork. Alternatives include calling clamd directly or using other ClamAV PHP clients, but you will still need the same daemon and failure-policy work.
Weaver
How can I help you explore Laravel packages today?