jord-jd/laravel-malware-validation-rule

Scans uploaded files for viruses and other malware

v2.1.0 2026-07-18 10:50 UTC

Requires

• php: >=7.2
• laravel/framework: ^5.1 || ^6.0 || ^7.0 || ^8.0 || ^9.0 || ^10.0 || ^11.0 || ^12.0 || ^13.0
• xenolope/quahog: ^2.1

Requires (Dev)

• phpunit/phpunit: ^7.5 || ^8.0 || ^9.6 || ^12.0

Replaces

• divineomega/laravel-malware-validation-rule: v2.1.0

LGPL-3.0-only

• Jordan Hall

Published on Packagist.org on 2026-07-18 10:51 UTC

README

The Laravel Malware Validation Rule package provides a validation rule that scans uploaded files for viruses and other malware.

Supports Laravel 5.1 through 13 and PHP 7.2 through current releases.

Installation

To install the Laravel Malware Validation Rule package, run the following command

composer require jord-jd/laravel-malware-validation-rule

This package makes use of the ClamAV daemon to perform virus/malware scanning. You can install ClamAV in Ubuntu/Debian with the following command.

sudo apt install clamav-daemon

Your ClamAV installation should automatically update virus defintions. However, you can update your ClamAV virus definitions manually using the freshclam command. It is recommended to restart the ClamAV daemon after the virus definitions have been updated to ensure they take effect.

sudo freshclam
sudo service clamav-daemon restart

Usage

See the following basic usage example, which demonstrates how to validate a basic file upload does not contain contain a known virus/malware.

use \JordJD\LaravelMalwareValidationRule\Rules\Malware;

// ...

public function rules()
{
    return [
        'my_file' => ['required', 'file', new Malware()],
    ];
}

For non-default ClamAV installations, inject a configured scanner. Unix sockets and TCP socket URIs are supported by the underlying client:

use JordJD\LaravelMalwareValidationRule\Scanner;

$scanner = new Scanner('tcp://clamav.internal:3310', 10);
$rule = new Malware(true, $scanner);

Connection, daemon, and unreadable-file failures are normalised to MalwareScanFailedException; applications can report or retry these separately from an infected-file validation failure.

By default the validation rule message will include the name of the detected virus/malware. If you do not wish the malware name to be shown in the validation message you can turn this off as shown below.

public function rules()
{
    $showMalwareName = false;

    return [
        'my_file' => ['required', 'file', new Malware($showMalwareName)],
    ];
}