← Dashboard

Safeview Download Inspection PXY-6221

The fix governs response-path isolation only: the request is allowed, tungsten fetches the origin, and the response policy returns isolate with file_download: true — which tungsten must collapse to content inspection, because a binary download cannot be rendered remotely. To reach that path without a direct_on_allow surrogate, each download below targets the host you loaded this page from (an allowed host, since you reached the page) and carries a fake X-Powered-By: PHP/5.3.3 header so PE's vulnerable-service detection returns isolate on the response.

Policy setup (required)

This scenario only works against a tenant configured as follows. Without it you will either get a plain download (no isolation triggered) or request-path isolation (the thin client, not this fix).
  1. Vulnerable-service policy = isolate. This is what makes PE return isolate on the response when it sees the fake X-Powered-By: PHP/5.3.3 these links send. This is the whole point — without it the response is just allowed.
  2. The host you load this page from must resolve to allow at request time (it does, since you reached the page). The request must pass through so tungsten fetches the origin and reaches the response policy. Do not use an isolate. host here — that isolates at request time and the thin client handles the download itself, bypassing this fix entirely.
  3. Tenant capabilities for content inspection (file-server hash/AV) must be enabled, so the collapsed content_inspect verdict actually scans and emits the Druid log.

Page origin: . caesium serves identical content on every hostname; the policy is applied by tungsten based on the target host below.

Presets:
FileWhat it exercisesOpen
What "did the right thing" looks like:
• req.action = allow (request passed through; no request-path isolation).
• resp.action = content_inspect (NOT isolate) — the fix collapsed the verdict.
• Druid entry exists with sha256_score and av_scan_result populated.
• no thin-client / safeview page; the file downloads (or EICAR returns a 403 block).

If you see the thin client instead: the request was isolated at request time — wrong host (use the bare caesium.menlotest.com, not isolate.) or the request policy is isolating. The fix cannot run on a request-isolated download.
If resp.action = isolate (no collapse): PE returned isolate on the response but without file_download: true, so the fix's input never occurred.