Hi,
Wondering what people think about adding the ability to disable identify on file attachment.
We’d like to scan the file first for malware before reading the first bytes for the mime-type. Maybe even adding it to the AnalyzeJob instead.
You could also write your own analyzer and disable to the default analyzer.
1 Like
Interesting, I don’t think a custom analyzer changes this particular ordering, since identify_without_saving happens separately while the attachment is being created.
If the requirement is really “scan before Active Storage reads the file for MIME detection,” I’d probably put the upload through a quarantine step first, scan it there, and only let it enter the normal attachment flow after it passes. Moving identification later in Rails could make this cleaner, but for a strict security requirement I’d rather keep the scan boundary explicit.