fix: disable download of infected submissions

Author: rakibansary

.circleci/config.yml

@@ -343,7 +343,7 @@ workflows:
             branches:
               only:
                 - develop
-                - fix/regsource
+                - fix/infected-submission
       # This is alternate dev env for parallel testing
       - "build-test":
           context : org-global      

package.json

@@ -232,5 +232,8 @@
     "webpack-pwa-manifest": "^3.7.1",
     "webpack-stats-plugin": "^0.2.1",
     "workbox-webpack-plugin": "^3.6.2"
+  },
+  "volta": {
+    "node": "8.11.2"
   }
 }

src/shared/components/SubmissionManagement/Submission/index.jsx

@@ -14,7 +14,7 @@
 import _ from 'lodash';
 import moment from 'moment';
 import React from 'react';
-import { COMPETITION_TRACKS, CHALLENGE_STATUS } from 'utils/tc';
+import { COMPETITION_TRACKS, CHALLENGE_STATUS, safeForDownload } from 'utils/tc';
 
 import PT from 'prop-types';
 
@@ -54,7 +54,7 @@ export default function Submission(props) {
       {
         track === COMPETITION_TRACKS.DES && (
           <td styleName="status-col">
-            {submissionObject.screening
+            {!safeForDownload(submissionObject.url) ? 'Malware found in submission' : submissionObject.screening
               && (
               <ScreeningStatus
                 screeningObject={submissionObject.screening}
@@ -71,7 +71,7 @@ export default function Submission(props) {
             onClick={() => onDownloadSubmission(submissionObject.id)}
             type="button"
           >
-            <DownloadIcon />
+            { safeForDownload(submissionObject.url) && <DownloadIcon /> }
           </button>
           { /*
             TODO: At the moment we just fetch downloads from the legacy
@@ -127,6 +127,7 @@ Submission.propTypes = {
     type: PT.string,
     created: PT.any,
     download: PT.any,
+    url: PT.string,
   }),
   showScreeningDetails: PT.bool,
   track: PT.string.isRequired,

src/shared/utils/tc.js

@@ -305,4 +305,13 @@ export function isValidEmail(email) {
   return pattern.test(email);
 }
 
+/**
+ * Test if the file is safe for download. This patch currently checks the location of the submission
+ * to determine if the file is infected or not. This is an immedaite patch, and should be updated to
+ * check the review scan score for review type virus scan.
+ */
+export function safeForDownload(url) {
+  return url != null && url.indexOf('submissions-quarantine/') === -1;
+}
+
 export default undefined;