Cloudflare.ContentScanning reference

ContentScanning

Source: src/Cloudflare/ContentScanning/ContentScanning.ts

WAF Content Scanning (malicious uploads detection) on a Cloudflare zone — the /zones/{zone_id}/content-upload-scan/settings singleton toggle.

Content Scanning is a zone singleton: the setting always exists (default disabled), so this resource never creates or deletes anything physical. Reconcile PUTs the status only when the observed value differs from the desired one; destroy restores the status the zone had before Alchemy first managed it (captured as initialValue).

Content Scanning is an Enterprise paid add-on. Reading the status works on every plan, but enabling it on a zone without the add-on fails with the typed ContentScanningNotEntitled error.

ContentScanning: Enabling Content Scanning

Turn on malicious-upload scanning for a zone

const zone = yield* Cloudflare.Zone.Zone("Site", { name: "example.com" });

yield* Cloudflare.ContentScanning.ContentScanning("UploadScanning", {
  zoneId: zone.zoneId,
});

Pin Content Scanning off

yield* Cloudflare.ContentScanning.ContentScanning("UploadScanning", {
  zoneId: zone.zoneId,
  enabled: false,
});

ContentScanning: Custom scan expressions

const scanning = yield* Cloudflare.ContentScanning.ContentScanning("UploadScanning", {
  zoneId: zone.zoneId,
});

yield* Cloudflare.ContentScanning.Expression("ScanJsonFile", {
  zoneId: scanning.zoneId,
  payload: 'lookup_json_string(http.request.body.raw, "file")',
});

Expression

Source: src/Cloudflare/ContentScanning/Expression.ts

A custom scan expression (“payload”) for WAF Content Scanning — tells the malicious-uploads scanner where to find encoded or nested content in the request body (/zones/{zone_id}/content-upload-scan/payloads).

An expression’s identity is its payload text within the zone: the API offers create/list/delete only (no update), so changing payload triggers a replacement. The zone must have Content Scanning enabled (see Cloudflare.ContentScanning.ContentScanning) — payload calls on a zone where scanning is disabled fail with the typed ContentScanningNotEnabled error.

Safety: expressions carry no ownership markers. When there is no prior state, read scans the zone for an expression with the same payload text and reports it as Unowned, so the engine refuses to take it over unless --adopt (or adopt(true)) is set.

Expression: Creating expressions

Scan a JSON-embedded file field

const scanning = yield* Cloudflare.ContentScanning.ContentScanning("UploadScanning", {
  zoneId: zone.zoneId,
});

yield* Cloudflare.ContentScanning.Expression("ScanJsonFile", {
  zoneId: scanning.zoneId,
  payload: 'lookup_json_string(http.request.body.raw, "file")',
});

Scan a base64-encoded form field

yield* Cloudflare.ContentScanning.Expression("ScanBase64Document", {
  zoneId: scanning.zoneId,
  payload: 'base64_decode(http.request.body.form["document"][0])',
});