Does Atlassian scan files that are attached with JIRA tickets or are stored in Confluence?

Question

How does Atlassian scan for any such malicious files? Are those files blocked from being uploaded? Does this happen with .zip files as well?

Do we have an option to limit the extensions of the files being uploaded? Can we allow only certain file extensions? Does this happen by default or on an organization level?

Alexis Robert · Answer

Hi @Sachindra Narayan ,

at the moment, there is no mechanism to prevent a user uploading a malicious file.

There are probably security measures taken by Atlassian to prevent code execution or similar threats.

Sachindra Narayan · Answer

@Alexis Robert  this does help. But currently in case any user uploads a malicious file to the JIRA Cloud, there is no mechanism to prevent that file from doing what that file is intended to do? Meaning the file can, lets say, delete cloud files, or corrupt them??

Alexis Robert · Answer

Hi @Sachindra Narayan ,

there is no mechanism in Jira or Confluence Cloud to scan or limit attachment type.

There are 2 tickets opened with Atlassian to add these features :

* Virus scan
* File type whitelist

You should vote for these issues and then keep an eye on these.

Let me know if this helps,

--Alexis