Merge pull request #6056 from topcoder-platform/fix/infected-submission

fix: disable download of infected submissions

Author: luizrrodrigues

.circleci/config.yml

@@ -343,7 +343,7 @@ workflows:
             branches:
               only:
                 - develop
-                - fix/regsource
+                - fix/infected-submission
       # This is alternate dev env for parallel testing
       - "build-test":
           context : org-global      

__tests__/shared/components/SubmissionManagement/__snapshots__/Submission.jsx.snap

@@ -24,14 +24,7 @@ exports[`Snapshot match 1`] = `
       <button
         onClick={[Function]}
         type="button"
-      >
-        <DownloadIcon
-          height="16"
-          viewBox="0 0 16 16"
-          width="16"
-          xmlns="http://www.w3.org/2000/svg"
-        />
-      </button>
+      />
       <button
         className="src-shared-components-SubmissionManagement-Submission-___styles__delete-icon___2M67z"
         disabled={true}
@@ -87,14 +80,7 @@ exports[`Snapshot match 2`] = `
       <button
         onClick={[Function]}
         type="button"
-      >
-        <DownloadIcon
-          height="16"
-          viewBox="0 0 16 16"
-          width="16"
-          xmlns="http://www.w3.org/2000/svg"
-        />
-      </button>
+      />
       <button
         className="src-shared-components-SubmissionManagement-Submission-___styles__delete-icon___2M67z"
         disabled={true}
@@ -123,4 +109,4 @@ exports[`Snapshot match 2`] = `
     </div>
   </td>
 </tr>
-`;
+`;

package.json

@@ -232,5 +232,8 @@
     "webpack-pwa-manifest": "^3.7.1",
     "webpack-stats-plugin": "^0.2.1",
     "workbox-webpack-plugin": "^3.6.2"
+  },
+  "volta": {
+    "node": "8.11.2"
   }
 }

src/shared/components/SubmissionManagement/Submission/index.jsx

@@ -14,7 +14,7 @@
 import _ from 'lodash';
 import moment from 'moment';
 import React from 'react';
-import { COMPETITION_TRACKS, CHALLENGE_STATUS } from 'utils/tc';
+import { COMPETITION_TRACKS, CHALLENGE_STATUS, safeForDownload } from 'utils/tc';
 
 import PT from 'prop-types';
 
@@ -38,6 +38,7 @@ export default function Submission(props) {
   } = props;
   const formatDate = date => moment(+new Date(date)).format('MMM DD, YYYY hh:mm A');
   const onDownloadSubmission = onDownload.bind(1, submissionObject.id);
+  const safeForDownloadCheck = safeForDownload(submissionObject.url);
 
   return (
     <tr styleName="submission-row">
@@ -54,7 +55,7 @@ export default function Submission(props) {
       {
         track === COMPETITION_TRACKS.DES && (
           <td styleName="status-col">
-            {submissionObject.screening
+            {safeForDownloadCheck !== true ? safeForDownloadCheck : submissionObject.screening
               && (
               <ScreeningStatus
                 screeningObject={submissionObject.screening}
@@ -71,7 +72,7 @@ export default function Submission(props) {
             onClick={() => onDownloadSubmission(submissionObject.id)}
             type="button"
           >
-            <DownloadIcon />
+            { safeForDownloadCheck === true && <DownloadIcon /> }
           </button>
           { /*
             TODO: At the moment we just fetch downloads from the legacy
@@ -127,6 +128,7 @@ Submission.propTypes = {
     type: PT.string,
     created: PT.any,
     download: PT.any,
+    url: PT.string,
   }),
   showScreeningDetails: PT.bool,
   track: PT.string.isRequired,

src/shared/utils/tc.js

@@ -305,4 +305,26 @@ export function isValidEmail(email) {
   return pattern.test(email);
 }
 
+/**
+ * Test if the file is safe for download. This patch currently checks the location of the submission
+ * to determine if the file is infected or not. This is an immedaite patch, and should be updated to
+ * check the review scan score for review type virus scan.
+ *
+ * @returns {String|Boolean} true if submission is safe for download,
+ * otherwise string describing reason for not being safe for download
+ */
+export function safeForDownload(url) {
+  if (url == null) return 'Download link unavailable';
+
+  if (url.toLowerCase().indexOf('submissions-quarantine/') !== -1) {
+    return 'Malware found in submission';
+  }
+
+  if (url.toLowerCase().indexOf('submissions-dmz/') !== -1) {
+    return 'AV Scan in progress';
+  }
+
+  return true;
+}
+
 export default undefined;