Upload Torture Test Pack

One archive covering the whole upload validation checklist. Point your upload endpoint at it and work through the README: each file names the check it exercises and what a correct implementation does with it. Nothing here is malware, and nothing here needs a network connection to be dangerous, because none of it is dangerous. It is all inert data designed to be mishandled.

↓ Download upload-torture-pack.zip22 files · 1.0 MB zipped

SHA-256 ccdfb70856e375153309efea81762f6c4d680aae8237d6d2b51aba9a963d08fe

What is inside

File	Format	Size	Expected result
0b.bin	Binary	0 bytes	Rejected: an empty file is not a valid upload.
1b.bin	Binary	1 bytes	Accepted. Proves the zero-byte rejection is not an off-by-one.
1mb.bin	Binary	1.0 MB	Accepted or rejected by your size cap, never buffered whole into memory.
spaces in name.txt	TXT	142 bytes	Stored under a generated name; the original kept only as a label.
report.pdf.exe	TXT	142 bytes	Rejected by the allow-list, matched on the real final extension.
CON.txt	TXT	142 bytes	Never written to disk as CON on Windows.
trailing-dot.txt.	TXT	142 bytes	Trailing dot stripped or the name rejected; Windows silently drops it.
invoice‮gnp.txt	TXT	142 bytes	The right-to-left override is stripped before the name is ever displayed.
日本語ファイル名.txt	TXT	142 bytes	Round-trips unchanged, NFC-normalised.
percent%20encoded.txt	TXT	142 bytes	Not double-decoded into a space.
fake-jpeg-is-executable.jpg	JPEG (spoofed)	2.1 KB	Rejected: the extension says JPEG, the bytes disagree.
no-extension	PNG (no extension)	183 bytes	Identified as PNG from its signature, not from a missing extension.
svg-with-script.svg	SVG	457 bytes	Sanitised, rasterised, or served from a separate origin. Never inline.
polyglot-gif-html.gif	GIF + HTML polyglot	192 bytes	Served with nosniff so it can only ever be treated as an image.
corrupt-missing-content-types.docx	DOCX	577 bytes	Rejected at parse time: a valid ZIP that is not a valid DOCX.
zip-slip-traversal.zip	ZIP	357 bytes	Entry refused. Nothing written outside the extraction directory.
absolute-path.zip	ZIP	161 bytes	Entry refused.
modest-zip-bomb.zip	ZIP	996 KB	Extraction aborted once the decompressed total passes your limit.
billion-laughs.xml	XML	794 bytes	Rejected: entity expansion disabled.
xxe-file-disclosure.xml	XML	141 bytes	Parsed with no file read attempted.
deeply-nested-100000.json	JSON	195 KB	Rejected at a depth limit rather than overflowing the stack.
formula-injection.csv	CSV	357 bytes	Stored as text. Cells beginning = + - @ escaped on export.

Also in the archive: a README.md repeating this table with full digests, a manifest.json for scripting, and a SHA256SUMS you can check with sha256sum -c. Every file is generated from source, carries no third-party copyright, and is free to redistribute.

The largest file here is 1 MB, deliberately: this pack is meant to be cheap to fetch in CI on every run. To exercise a real size cap, pull a specific size from https://hexaqa.com/size-ladder (up to 250 MB stored) or stream anything up to 2 GB from https://hexaqa.com/generator.

Questions

What is in the upload torture test pack?

Twenty-two files covering the whole upload validation checklist: a zero-byte file, a 10 MB file, seven filename edge cases, a spoofed JPEG, a PNG with no extension, an SVG carrying a script, a GIF that is also an HTML page, a corrupt DOCX, three hostile archives, two XML attacks, deeply nested JSON and a formula-injection CSV. The README in the archive says what each one should do.

Is this pack safe to download?

Yes. Nothing in it is malware and nothing executes on download. The files are inert data built to be mishandled by software that parses them carelessly. Extract it somewhere disposable anyway, because two of the archives inside are specifically designed to write outside their extraction directory if your extractor lets them.

How do I use it in CI?

The archive has a stable URL and a published SHA-256, so you can fetch and verify it in a pipeline step, then post each file to your upload endpoint and assert on the status code. The manifest.json inside lists every file with its digest and expected result.

Other packs

Filename Compatibility Pack · Encoding and Unicode Pack · Archive and ZIP Security Pack · Document Parser Pack · Image Pipeline Pack · Structured Data Pack · Email Parser Pack