mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 00:29:48 +03:00
Test files can cause "Trojan" warnings on some systems #1292
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @infario on GitHub (Aug 2, 2019).
While I tried to install this on my server my cpanel antivirus reported trojan virus infection this source files
@Abijeet commented on GitHub (Aug 2, 2019):
Hi @infario
Can you add some more info or logs from the antivirus?
@infario commented on GitHub (Aug 2, 2019):
The file you uploaded, BookStack-master.zip, contains a virus so the upload was canceled: Win.Trojan.Hide-2 FOUND
@Abijeet commented on GitHub (Aug 2, 2019):
Can you share what hosting provider you use? Any ideas about what AV software they use?
On a side note, you can download the latest release of BookStack from the release section here - https://github.com/BookStackApp/BookStack/releases
The master branch is for development purpose.
@infario commented on GitHub (Aug 2, 2019):
I tried the release BookStack Beta v0.26.3 and still get same error. We use Panel secure hosting. I guess they are using ClamAV Antivirus
@dawolf commented on GitHub (Aug 2, 2019):
Automated malware scanners seem to pick up files in the
/tests/test-datadirectory.@infario commented on GitHub (Aug 2, 2019):
Can i delete "tests" folder and upload?
@Abijeet commented on GitHub (Aug 2, 2019):
@infario - Yes that should work fine.
@infario commented on GitHub (Aug 2, 2019):
Yes now the virus error gone. Thanks @dawolf and @Abijeet
@Abijeet commented on GitHub (Aug 2, 2019):
Re-opening this in order to bring to @ssddanbrown's attention, and maybe make a more long term fix.
@dawolf commented on GitHub (Aug 2, 2019):
These files should be removed from the release if they get picked up by malware scanners.
edit: ninja'd by @Abijeet
@ssddanbrown commented on GitHub (Aug 3, 2019):
Thanks @Abijeet for responding to this.
Yeah, Once we get to a point where we have packaged releases then the test files should not be included. GitHub just provides the current zip as a straight ZIP of the source. Have updated the title and will leave this open as a reminder for when we come to change the release process.
@LordSimal commented on GitHub (Sep 14, 2019):
I just want to mention, that my hoster https://all-inkl.com/ reported those 2 PHP files as described above.
I now have deleted the tests folder but a "real solution" would be nice.
@stenootje commented on GitHub (Apr 9, 2020):
April 2020 and this is still not removed... why?
even more, why is this included? a php-file and phtml-file that are images!!
@ssddanbrown commented on GitHub (Apr 9, 2020):
@stenootje Because we have not developed a packaged release system yet.
Because we have tests to ensure these types of files cannot be uploaded.
@stenootje commented on GitHub (Apr 9, 2020):
so this directory can be removed from installation without causing other problems?
@ssddanbrown commented on GitHub (Apr 9, 2020):
@stenootje The directory can be removed. If you installed using
git cloneto pull down the files, then it's possible you may get some warnings or error when pulling down the code for an update.@LordSimal commented on GitHub (Apr 9, 2020):
If these files are "just" to test the upload (while developing) why does it have to be in a production environment?
Could this be solved with a production and development branch?
@ssddanbrown commented on GitHub (Apr 9, 2020):
It's ideal to be able to run the tests against the exact branch of code that people are using, They'll never run in production but they're useful to be there.
Yeah, most likely. We pretty much already have that with
masteras our development branch andreleaseas our production branch, is just working around the above (ensure we're testing production-intended code) and putting process in place. Just wasn't looking to spend time updating our dev/release process to account for just this since I ultimately want to change the release process anyway.@liudass84 commented on GitHub (May 12, 2020):
FILE HIT LIST:
{CAV}Win.Trojan.Hide-2 : /.../tests/test-data/bad.php
{CAV}Win.Trojan.Hide-2 : /.../tests/test-data/bad.phtml
@ssddanbrown commented on GitHub (Feb 6, 2021):
Within
f25e585008I've re-worked these files for our testing usage to avoid them getting picked up by AV, Have tested with ClamAV. Will be part of the next feature release.