在Node.js文件上传中集成ClamAV扫描的详细步骤

npm install pompelmi

# macOS
brew install clamav && freshclam
# Debian / Ubuntu
sudo apt-get install -y clamav clamav-daemon && sudo freshclam
# Windows
choco install clamav -y

const { scan, Verdict } = require('pompelmi');

const result = await scan('/path/to/file.zip');

switch (result) {
  case Verdict.Clean:
    // 文件安全，继续处理
    break;
  case Verdict.Malicious:
    throw new Error('检测到恶意软件，文件已拒绝');
  case Verdict.ScanError:
    // 扫描未完成，按不可信文件处理
    console.warn('扫描失败，拒绝文件');
    break;
}

const express = require('express');
const multer  = require('multer');
const { scan, Verdict } = require('pompelmi');
const path = require('path');
const fs   = require('fs');

const app    = express();
const upload = multer({ dest: 'tmp/' });

app.post('/upload', upload.single('file'), async (req, res) => {
  const filePath = path.resolve(req.file.path);

  try {
    const result = await scan(filePath);

    if (result === Verdict.Malicious) {
      fs.unlinkSync(filePath);
      return res.status(422).json({ error: '文件包含恶意软件' });
    }

    if (result === Verdict.ScanError) {
      fs.unlinkSync(filePath);
      return res.status(422).json({ error: '扫描失败，文件已拒绝' });
    }

    // Verdict.Clean — 继续保存文件
    return res.status(200).json({ verdict: 'clean' });

  } catch (err) {
    fs.unlinkSync(filePath);
    return res.status(500).json({ error: err.message });
  }
});

const result = await scan('/path/to/file.zip', {
  host: '127.0.0.1',
  port: 3310,
});

try {
  const result = await scan(path.resolve(filePath));
  return result;
} catch (err) {
  // filePath 不是字符串      → 'filePath must be a string'
  // 文件不存在               → 'File not found: <path>'
  // clamscan 不在 PATH 中    → ENOENT
  // 未知退出码               → 'Unexpected exit code: N'
  console.error('扫描异常:', err.message);
  return null;
}