fix: ClamAV scan crash on codebase root directory (#2190)

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

Makefile

@@ -32,6 +32,10 @@ run:
 	@echo "-> Run the Docker compose services in dev mode (hot reload on code changes)"
 	${COMPOSE} up
 
+start:
+	@echo "-> Start the Docker compose services in background"
+	${COMPOSE} up -d
+
 bash:
 	# Open a bash session in the running web container
 	${COMPOSE} exec web bash
@@ -219,4 +223,4 @@ offline-package: docker-images
 	@mkdir -p dist/
 	@tar -cf dist/scancodeio-offline-package-`git describe --tags`.tar build/
 
-.PHONY: virtualenv conf dev envfile install doc8 check valid check-deploy clean migrate lock makemigrations restart-worker postgresdb sqlitedb backupdb run test fasttest regen-fixtures fix docs build build-core build-full bash shell docker-images offline-package
+.PHONY: virtualenv conf dev envfile install doc8 check valid check-deploy clean migrate lock makemigrations restart-worker postgresdb sqlitedb backupdb run test fasttest regen-fixtures fix docs build build-core build-full bash start shell docker-images offline-package

scanpipe/pipes/clamav.py

@@ -20,12 +20,15 @@
 # ScanCode.io is a free software code scanning tool from nexB Inc. and others.
 # Visit https://github.com/aboutcode-org/scancode.io for support and download.
 
+import logging
 from pathlib import Path
 
 from django.conf import settings
 
 import clamd
 
+logger = logging.getLogger("scanpipe.pipes")
+
 
 def scan_for_virus(project):
     """
@@ -46,11 +49,17 @@ def scan_for_virus(project):
     except clamd.ClamdError as e:
         raise Exception(f"Error with the ClamAV service: {e}")
 
+    infected_count = 0
     for resource_location, results in scan_response.items():
         status, reason = results
+
         resource_path = Path(resource_location).relative_to(project.codebase_path)
+        if str(resource_path) == ".":
+            # ClamAV reports the codebase directory itself, rather than a file,
+            # as a summary entry when the scan found nothing to flag.
+            continue
 
-        resource = project.codebaseresources.get(path=resource_path)
+        resource = project.codebaseresources.get(path=str(resource_path))
         virus_report = {
             "clamav": {
                 "status": status,
@@ -68,3 +77,6 @@ def scan_for_virus(project):
                 "resource_path": str(resource_path),
             },
         )
+        infected_count += 1
+
+    logger.info(f"ClamAV scan completed: {infected_count} infected")

scanpipe/tests/pipes/test_clamav.py

@@ -67,3 +67,18 @@ def test_scanpipe_pipes_clamav_scan_for_virus(self, mock_multiscan):
             }
         }
         self.assertEqual(expected_virus_report_extra_data, resource1.extra_data)
+
+    @mock.patch("clamd.ClamdNetworkSocket.multiscan")
+    def test_scanpipe_pipes_clamav_scan_for_virus_no_detection(self, mock_multiscan):
+        project = Project.objects.create(name="project")
+        make_resource_file(project=project, path="file.txt")
+
+        mock_multiscan.return_value = {
+            str(project.codebase_path): ("OK", None),
+        }
+
+        clamav.scan_for_virus(project)
+        self.assertEqual(0, len(project.projectmessages.all()))
+
+        resource = project.codebaseresources.first()
+        self.assertEqual({}, resource.extra_data)