Synthetic teaching example for a website delivery brief. Not a client result, live account test or certification.
“Upload works” is not a sufficient handover test
A quote form for a new business website may need a reference image, not arbitrary executable content or private building records. Begin with the minimum useful attachment types and a clear size limit. The upload control’s accept attribute is a user-interface hint, not evidence that the server enforces the same policy.
| Synthetic file metadata | Result | Why it is not a safety certificate |
|---|---|---|
| room.png, PNG declaration/header, 68 bytes | NEXT_REVIEW_NOT_SAFE | Only supplied initial checks agree |
| quote.pdf with PNG header | OUTSIDE_PNG_ONLY_BRIEF | Filename is outside the agreed scope |
| concept.svg | OUTSIDE_PNG_ONLY_BRIEF | Different format needs a separate policy |
| large.png, 2048 bytes | REJECT_SIZE | This example limit is 1024 bytes |
Use the filled example
Download the finite Node checker and filled input. Run with Node 24 or newer; no account, API or network is used.
node checks.mjs quote-upload-review quote-upload-review.jsonThe fixture deliberately uses a tiny 1KB policy for easy testing, not a recommendation for a usable production upload limit. It examines supplied metadata and a few initial bytes, not a complete file decoder. A valid-looking PNG signature does not prove the rest of the file is safe, correctly decoded or free from malicious content.
A useful supplier acceptance brief
Specify required types, byte limits, server-side verification and who may upload or retrieve attachments. Ask where files are stored, how names are generated and whether an uploaded file can become executable or publicly discoverable. Review malware scanning or content disarm where appropriate and define retention and failure handling.
Test a renamed file, an oversized body and an unauthorised retrieval in a permitted environment. Preserve the rejected sample and response evidence without publishing customer attachments. A storage URL should not leak private plans merely because the marketing form succeeded.
This resource uploads nothing and creates no public file-receiving endpoint. Its four JSON examples are inert metadata, not attack files. The result NEXT_REVIEW_NOT_SAFE deliberately stops before a safety decision; a real website implementation needs layered controls and a reviewed threat model.
Primary facts and limits
OWASP file-upload guidance: Recommends layered checks; extension, supplied MIME type or file signature alone is insufficient.
Sources reviewed 15 October 2026. The supplied input and acceptance rules are original teaching design; check current platform versions and your actual delivery contract before implementation.