Antivirus scanning is designed to prevent users from downloading potentially malicious file attachments from Quip onto their local machine. This is an additional safeguard we provide to Quip Shield customers, in addition to the numerous safeguards already implemented in Quip’s architecture.
Quip Antivirus Scanning is available to Quip sites that have purchased Quip Shield or the Antivirus Scanning functionality.
- Once the feature is enabled, any new file uploaded to Quip will be scanned upon initial upload for potential viruses. This includes file attachments in the Quip document itself, as well as attachments in Quip messages and comments (also referred to as annotations). The scan may take up to 60 seconds to complete.
- During the pending state (prior to being scanned), end users will be unable to download the file and will see a warning: “This file is still being scanned. Please try again in 60 seconds.” Users should wait for a minute and then attempt to download the file again.
- In the event that a virus is identified in an uploaded file, a user who attempts to download the file will see a warning: “This file has malicious content and cannot be downloaded.” There is no manual override at this time; users who wish to gain access to this file should contact their administrator to work directly with the user who initially uploaded the file.
Scenarios where antivirus scanning will be executed
- When a file is added as an attachment to the body of the document
- When a file is added to the conversation thread of a document
- When a file is added to an in-line comment in the document
- In order to provide users with the best possible experience, images inserted into Quip will render immediately.
- Attachments will be scanned upon initial upload to Quip; they will not be rescanned nor will all existing attachments be scanned upon initially enabling the feature.
Quip admins can enable antivirus scanning by going to the Quip Admin Portal → Shield Advanced Security. From there, they can then enable Quip Antivirus Scanning. Only once this feature is enabled will new uploads be scanned for viruses.
Antivirus scanning can be tested using a standard EICAR test file, available on the EICAR website. To test, download the test file(s) from that site and upload it into Quip using Insert → File, without editing or modifying the file. After scanning has completed, attempt to download the file to verify that it can’t be downloaded and the warning message appears.