How can I make sure that users cannot upload files containing known malware?
I can upload files and tried to find anything related to malware or virus in the Firebase documentation. There was nothing said about it.
Cloud Storage is not concerned with the contents of the files uploaded to a storage bucket, as long as you're following the terms of service. As far as it's concerned, it's all just sequences of bytes. If you want to apply some virus protection, you need to do that on your own before uploading. Or check after uploading, then remove the content you don't want to keep.