When file transfer is permitted by policy, Dejanu treats it as a controlled workflow with a verdict at the end—never a silent "just download it." Every file that crosses the isolation boundary, in either direction, is inspected before it is allowed through.
The Upload Pipeline, Step by Step
- Policy and size checks in the interface — Before a single byte leaves the browser, the viewer blocks disallowed file types and oversized files, so obvious violations never even start.
- Metadata handshake — The client first announces the file (name, declared type, size) over the WebRTC data channel and waits for permission.
- Allow or deny in the isolated runtime — The container checks upload permissions and the allowed/denied type lists, then answers allowed or denied before any content is sent.
- Chunked transmission with flow control — Approved files move in 64 KB chunks, pausing for the channel buffer to drain so a slow network can't cause the transfer to collapse.
- Strict validation — The runtime accepts exactly the expected number of bytes (rejecting both over- and under-sized streams) and re-detects the file type from its actual content, not its extension, requiring it to match what was declared.
- Sanitizer verdict — Finally the file is scanned by ClamAV, with optional VirusTotal escalation across dozens of engines, and only a clean verdict releases it.
Download Protection Works the Same Way
Downloads are not an afterthought. The runtime watches the browser's download directory, detects when a file is complete, scans it, and only then streams the bytes back to the client, which reassembles the file locally. Throughout, the user sees clear, honest states—processing → clean/done, or infected/denied—instead of a spinner that fails silently.
The Details That Matter in Production
- Content-based type detection — Renaming
malware.exetoinvoice.pdfdoesn't help; the type is judged from the bytes. - Result caching by hash — A file whose hash is already known-clean isn't rescanned, keeping common transfers fast without weakening safety.
- Independent direction policy — You can allow PDF downloads while blocking executable uploads, or any combination your risk model calls for.
Every file that crosses the boundary gets a verdict. There is no quiet path around the scanner.
Why This Design Holds Up
The strength here isn't any single check—it's that policy, validation, and scanning sit inside the isolated runtime and on the network path, not in the user's browser where they could be tampered with. The boundary is enforced where the attacker isn't.