Structured Data Pack
Two kinds of file in here. The valid ones test that your importer reads what is actually there, including quoted commas and embedded newlines. The hostile ones test that it gives up cleanly instead of exhausting memory or reading a file off your server.
SHA-256 d2c89d98b02cea51e48b8faaec96e9ae5f5757b515859f4ff16d83e9a16a645d
What is inside
| File | Format | Size | Expected result |
|---|---|---|---|
| valid-simple.csv | CSV | 4.3 KB | Parses. The control. |
| quoting-nightmare.csv | CSV | 407 bytes | Quoted fields containing commas and newlines kept intact. |
| bom-and-semicolons.csv | CSV | 124 bytes | BOM stripped, semicolon delimiter detected. |
| ragged-rows.csv | CSV | 123 bytes | Rows with the wrong column count rejected or padded deliberately. |
| formula-injection.csv | CSV | 357 bytes | Leading = + - @ escaped on export to a spreadsheet. |
| valid-small.json | JSON | 382 bytes | Every scalar type, nesting, Unicode and escapes. Parses. |
| malformed-trailing-comma.json | JSON | 24 bytes | Rejected. It is not valid JSON, whatever your parser thinks. |
| precision-loss.json | JSON | 319 bytes | Integers above 2^53 preserved, or the loss handled knowingly. |
| deeply-nested-100000.json | JSON | 195 KB | Rejected at a depth limit, not by a stack overflow. |
| ndjson-10000-lines.ndjson | NDJSON | 654 KB | Streamed line by line rather than parsed whole. |
| valid.xml | XML | 395 bytes | Parses. The control. |
| billion-laughs.xml | XML | 794 bytes | Rejected: entity expansion disabled. |
| xxe-file-disclosure.xml | XML | 141 bytes | Parsed with external entity resolution off. |
| norway-problem.yaml | YAML | 161 bytes | The country code NO stays a string and does not become false. |
sha256sum -c. Every file is generated from source, carries no third-party copyright, and is free to redistribute.Questions
What is the YAML Norway problem?
In YAML 1.1 the unquoted value NO parses as the boolean false, so a list of country codes silently turns Norway into false. The file in this pack reproduces it along with the other implicit-typing traps.
What is CSV formula injection?
A cell beginning with =, + , - or @ is interpreted as a formula when the CSV is opened in Excel or Sheets, which can run on the victim machine. The file in this pack carries the standard payloads so you can prove your exporter escapes them.
Other packs
Upload Torture Test Pack · Filename Compatibility Pack · Encoding and Unicode Pack · Archive and ZIP Security Pack · Document Parser Pack · Image Pipeline Pack · Email Parser Pack