Storage test cases, for what happens to the bytes after they arrive

Most published upload testing stops at the moment the bytes arrive: type accepted, size enforced, progress shown. Everything consequential happens afterwards. The object gets a key, and if that key is sequential or derived from the filename then knowing one file lets an attacker enumerate the rest. It gets a URL, and if that URL never expires it is a permanent public link to private content the first time it appears in a log, an email or a referrer header. And it gets scanned, but scanning takes time, and the window between upload completing and the scan finishing is a window in which the file is retrievable.

Content type is the second theme and it is a trust question. A client declared type is an assertion by whoever uploaded the file, so determining type by inspection rather than by the declared value is what stops a script being served as one. Even then, serving user content from the application origin means an uploaded SVG or HTML file executes with access to the application session. The fix is a separate origin or a forced download, and it is one of the few genuinely dangerous defects that a functional test would never surface because the file uploads and downloads perfectly.

The lifecycle cases are where cost and compliance live. An interrupted multipart upload leaves parts behind that accumulate charges nobody can trace. A deleted record that leaves its object behind is both a storage bill and, more seriously, a deletion request that was not honoured, since the data is still there. A storage write that fails after the database row commits leaves a permanent broken link. None of these produce errors, which is precisely why they persist.

Finally, processing is a resource boundary. A small compressed image can declare enormous dimensions and expand to exhaust memory during decoding, so limits belong on the declared dimensions before decoding starts rather than on file size alone. A file that crashes the processor needs to be handled once and quarantined, not retried until the worker is permanently crash looping on it. And metadata stripping matters more than it sounds: a profile photograph published with its GPS coordinates intact tells everyone where the person was standing.