Use case · 25 files
Test file-type validation
Extensions and Content-Type headers are chosen by the uploader, so file-type checks have to look at the bytes. Each file here has a real format and a misleading or awkward name. A validator that sniffs content should identify every one correctly; one that trusts the name will not.
Download all with curl
# 25 files, 8.5 MB in total
while read -r url; do curl -LO --fail "$url"; done <<'EOF'
https://files.samplefiles.com/edge-cases/mislabeled/png-named.jpg
https://files.samplefiles.com/edge-cases/mislabeled/jpg-named.png
https://files.samplefiles.com/edge-cases/mislabeled/gif-named.png
https://files.samplefiles.com/edge-cases/mislabeled/webm-named.mp4
https://files.samplefiles.com/edge-cases/mislabeled/mp3-named.wav
https://files.samplefiles.com/edge-cases/mislabeled/json-named.csv
https://files.samplefiles.com/edge-cases/mislabeled/html-named.jpg
https://files.samplefiles.com/edge-cases/mislabeled/svg-named.png
https://files.samplefiles.com/edge-cases/mislabeled/zip-named.docx
https://files.samplefiles.com/edge-cases/mislabeled/docx-named.xlsx
https://files.samplefiles.com/edge-cases/mislabeled/pdf-named.docx
https://files.samplefiles.com/edge-cases/mislabeled/text-named.pdf
https://files.samplefiles.com/edge-cases/mislabeled/document
https://files.samplefiles.com/edge-cases/mislabeled/sample.php.jpg
https://files.samplefiles.com/edge-cases/mislabeled/UPPERCASE.JPG
https://files.samplefiles.com/image/jfif/sample-640x480.jfif
https://files.samplefiles.com/edge-cases/corrupt/bad-signature.png
https://files.samplefiles.com/edge-cases/corrupt/bad-header.jpg
https://files.samplefiles.com/image/png/sample-640x480.png
https://files.samplefiles.com/image/jpg/sample-640x480.jpg
https://files.samplefiles.com/image/webp/sample-640x480.webp
https://files.samplefiles.com/image/heic/sample-640x480.heic
https://files.samplefiles.com/document/pdf/sample-1-page.pdf
https://files.samplefiles.com/archive/zip/sample-mixed.zip
https://files.samplefiles.com/video/mp4/sample-720p-10s.mp4
EOFRead first: Corrupt files for testing error handling · How to test file uploads properly · Validating uploads: magic bytes vs extension vs MIME type
Wrong extension
Real image, audio, video and data files saved under another format’s extension.
| File | Size | Details | Download |
|---|---|---|---|
| PNG file named .jpgpng-named.jpg | 323 KB | Download | |
| JPG file named .pngjpg-named.png | 41.8 KB | Download | |
| GIF file named .pnggif-named.png | 108 KB | Download | |
| WebM video named .mp4webm-named.mp4 | 1.7 MB | Download | |
| MP3 file named .wavmp3-named.wav | 469 KB | Download | |
| JSON file named .csvjson-named.csv | 35.8 KB | Download |
Active content with an image name
HTML and SVG can run script in a browser. They must be rejected, or served with a safe Content-Type and nosniff.
| File | Size | Details | Download |
|---|---|---|---|
| HTML file named .jpghtml-named.jpg | 107 B | Download | |
| SVG file named .pngsvg-named.png | 651 B | Download |
Document and container lookalikes
DOCX and XLSX are ZIP files, so a signature check alone only says “ZIP”.
| File | Size | Details | Download |
|---|---|---|---|
| Plain ZIP named .docxzip-named.docx | 524 KB | Download | |
| DOCX file named .xlsxdocx-named.xlsx | 37 KB | Download | |
| PDF file named .docxpdf-named.docx | 3.1 KB | Download | |
| Text file named .pdftext-named.pdf | 31 B | Download |
Tricky names
No extension, a double extension, an uppercase extension and the .jfif name Windows gives some JPEGs.
| File | Size | Details | Download |
|---|---|---|---|
| PDF with no file extensiondocument | 3.1 KB | Download | |
| Double extension (.php.jpg)sample.php.jpg | 41.8 KB | Download | |
| Uppercase extension (.JPG)UPPERCASE.JPG | 41.8 KB | Download | |
| JFIF image (640×480)sample-640x480.jfif | 40.7 KB | 640×480 | Download |
Damaged signatures
Valid content whose magic bytes have been overwritten, so detection must fail cleanly.
| File | Size | Details | Download |
|---|---|---|---|
| PNG with a damaged signaturebad-signature.png | 323 KB | Download | |
| JPG with a damaged headerbad-header.jpg | 41.8 KB | Download |
Correctly named baselines
The same kinds of files with honest names, to confirm your validator accepts them.
| File | Size | Details | Download |
|---|---|---|---|
| PNG 640×480sample-640x480.png | 323 KB | 640×480 | Download |
| JPG 640×480sample-640x480.jpg | 41.8 KB | 640×480 | Download |
| WEBP 640×480sample-640x480.webp | 19.7 KB | 640×480 | Download |
| HEIC 640×480sample-640x480.heic | 35.7 KB | 640×480 | Download |
| PDF, 1 pagesample-1-page.pdf | 3.1 KB | 1 page | Download |
| ZIP with 6 mixed filessample-mixed.zip | 524 KB | 6 entries | Download |
| MP4 720p HD, 10 seconds (H.264)sample-720p-10s.mp4 | 3.8 MB | 1280×720 · 10s · H.264 | Download |
