douglasmun/aws-cdr-gateway

This tool automatically cleans uploaded files before your application trusts them. It strips potentially dangerous active content from Office documents, PDFs, and images, then routes the cleaned version to a safe storage location or sends the original to a quarantine bucket if it cannot be made safe. The process is called Content Disarmament and Reconstruction, or CDR. The cloud version runs as a serverless AWS function. When someone uploads a file to an S3 storage bucket, it triggers this pipeline automatically. Word documents, Excel spreadsheets, PDFs, and common image formats all pass through specific cleaning routines. For Office files, it removes macros, embedded scripts, external data connections, and other components that could execute code when someone opens the document. For PDFs, it strips JavaScript, auto-open actions, embedded files, and form actions. For images, it re-encodes the file from scratch to remove metadata that could carry malicious content. Files in older formats like the original .doc.xls, and .ppt are sent straight to quarantine because their internal structure makes safe reconstruction too risky. The tool follows a fail-closed principle: anything it cannot confirm as safe goes to quarantine. It never labels a file as sanitized unless the cleaning has been positively verified. A second mode runs the same cleaning engine as a plain HTTP service on your own computer or server, with no AWS account required. You send it a file via a web request and it returns the cleaned version. This makes it useful as a sidecar next to any web application that accepts uploads, regardless of what programming language the main application uses. The repository includes thorough test coverage (227 tests), deployment guides for AWS using either SAM or Terraform, Docker and Kubernetes deployment instructions for the local service, and documentation comparing its coverage against other known file security tools.