Browse the Knowledge Hub32 resources
Test cases
Upload test cases, because uploads accept attacker controlled bytes
Twenty eight cases covering size and type limits, content type spoofing, SVG script, path traversal filenames, archive bombs, storage quotas, interrupted and resumed transfers, post processing failures, metadata privacy and accessibility.
All 28 test cases, ready to copy
Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.
Last updated
28 worked examples
Upload a valid file of an allowed type
TypeFunctionalPriorityHigh- Test data
- Well formed PDF or PNG within the size limit
- Expected result
- Upload completes, progress reaches one hundred per cent, the file is listed with correct name and size, and it can be downloaded intact and byte identical.
Upload multiple files at once
TypeFunctionalPriorityMedium- Test data
- Five files selected together
- Expected result
- All are queued and reported individually. One failure does not silently abandon the rest.
Upload by drag and drop
TypeFunctionalPriorityMedium- Test data
- Drag from the desktop, and drag a folder
- Expected result
- Files accepted, folders either handled or refused with a clear message rather than appearing to work and uploading nothing.
Reject a file above the size limit
TypeBoundaryPriorityHigh- Test data
- Limit exactly, limit plus one byte, and ten times the limit
- Expected result
- The limit is accepted, anything above is refused with the limit stated, and the refusal happens before the whole file is transferred where the platform allows it.
Upload a zero byte file
TypeBoundaryPriorityMedium- Test data
- Empty file with a valid extension
- Expected result
- Refused with a clear message, or accepted deliberately. It must not create a record pointing at nothing.
Reject a disallowed file type
TypeNegativePriorityHigh- Test data
- .exe, .sh, .bat, .php, .jsp, .svg where not permitted
- Expected result
- Refused server side with the allowed list stated. The file input accept attribute is a convenience, never a control.
Upload a file whose extension does not match its contents
TypeSecurityPriorityHigh- Test data
- A PHP script renamed to image.png, and a PNG renamed to file.pdf
- Expected result
- Type is determined by inspecting content, not by the extension or the declared content type. Mismatches are refused.
Upload a polyglot file valid as two types
TypeSecurityPriorityHigh- Test data
- An image with script appended, or a GIF with embedded markup
- Expected result
- Either refused or served in a way that cannot execute: correct content type, download disposition, and ideally a separate domain for user content.
Upload an SVG containing script
TypeSecurityPriorityHigh- Test data
- SVG with an embedded script element and an event handler attribute
- Expected result
- Refused, sanitised, or served as an attachment rather than rendered inline. SVG is the most commonly overlooked cross site scripting vector in uploads.
Upload with a path traversal filename
TypeSecurityPriorityHigh- Test data
- ../../etc/passwd, ..\..\windows\system32\file.txt
- Expected result
- Filename is sanitised or replaced with a generated identifier. Nothing is written outside the intended storage location.
Upload with a filename containing special or unicode characters
TypeBoundaryPriorityMedium- Test data
- Quotes, semicolons, null bytes, right to left override, emoji, and a 300 character name
- Expected result
- Stored safely, displayed correctly, and downloadable with a sensible name. Long names are truncated rather than rejected with a server error.
Upload a file with the same name as an existing file
TypeStatePriorityHigh- Test data
- Identical filename uploaded twice
- Expected result
- Documented behaviour: versioned, renamed, or overwritten after confirmation. Silent overwriting of another user file is data loss.
Upload an archive containing many or deeply nested entries
TypeSecurityPriorityHigh- Test data
- A zip bomb, and an archive with traversal paths inside it
- Expected result
- If archives are expanded, limits on entry count, total expanded size and depth are enforced, and internal paths are sanitised. If not expanded, the archive is stored as an opaque blob.
Upload a file known to be malicious
TypeSecurityPriorityHigh- Test data
- The EICAR standard antivirus test file
- Expected result
- Detected and quarantined if scanning is in place, and the user is told. If no scanning exists, that is a risk decision worth recording rather than discovering later.
Attempt to upload without authorisation
TypeSecurityPriorityHigh- Test data
- Unauthenticated request, and a user without upload rights
- Expected result
- Refused at the endpoint, not merely hidden in the interface.
Attempt to read another user file
TypeSecurityPriorityHigh- Test data
- Substitute another identifier, and guess a sequential storage URL
- Expected result
- Refused. Storage URLs are unguessable and authorised, and public buckets do not serve private content.
Verify a file URL expires if it is meant to
TypeSecurityPriorityHigh- Test data
- Signed URL used after expiry, and shared with a different session
- Expected result
- Expired links refuse access. Live links do not become permanent public URLs.
Cancel an upload in progress
TypeStatePriorityMedium- Test data
- Cancel at roughly fifty per cent
- Expected result
- Transfer stops, no partial file is left visible or downloadable, and any temporary storage is cleaned up.
Lose the connection mid upload
TypeStatePriorityHigh- Test data
- Disable the network at fifty per cent, then restore it
- Expected result
- Either resume from where it stopped, or fail cleanly with a retry offered. A file that appears uploaded but is truncated is the worst outcome.
Upload a large file on a slow connection
TypePerformancePriorityHigh- Test data
- Largest allowed size throttled to a mobile speed
- Expected result
- Progress is accurate, no request timeout at the proxy or gateway, and the interface stays usable throughout.
Upload the same file twice in parallel
TypeStatePriorityMedium- Test data
- Two simultaneous uploads of one file
- Expected result
- Two distinct records or one deduplicated record, deliberately, with no corrupted result.
Exceed the per user or per account storage quota
TypeBoundaryPriorityHigh- Test data
- Upload up to the quota, then one file beyond it
- Expected result
- Refused with the remaining allowance stated. Quota is enforced server side and accounts for files awaiting processing.
Verify post processing completes and failures are visible
TypeStatePriorityHigh- Test data
- A file requiring thumbnailing, text extraction or transcoding, plus a deliberately corrupt one
- Expected result
- Successful processing updates the record. Failed processing surfaces as a clear state, not as a file stuck in processing forever.
Upload a corrupt or truncated file of an allowed type
TypeNegativePriorityMedium- Test data
- A PDF cut off halfway, an image with a broken header
- Expected result
- Refused during validation, or accepted and flagged. Nothing in the pipeline crashes on parsing it.
Check metadata handling on images
TypeSecurityPriorityMedium- Test data
- A photograph containing GPS coordinates in its metadata
- Expected result
- Location metadata is stripped for publicly visible images, or the retention is disclosed. Silently republishing a home address is a privacy incident.
Delete an uploaded file and verify it is gone
TypeFunctionalPriorityHigh- Test data
- Delete, then attempt the previous direct URL and the CDN URL
- Expected result
- Record removed and the bytes are no longer retrievable, including through cache. Deletion that only hides the record is not deletion.
Upload from a mobile device
TypeCompatibilityPriorityHigh- Test data
- Camera capture, photo library, and a cloud provider through the system picker, on iOS and Android
- Expected result
- All sources work, orientation is preserved, and backgrounding the app mid upload does not silently abandon it.
Operate the upload control by keyboard and screen reader
TypeAccessibilityPriorityHigh- Test data
- Keyboard only, then NVDA or VoiceOver
- Expected result
- The control is focusable and activatable with Enter or Space, has a real label, and progress plus completion and errors are announced. Drag and drop must always have a button alternative.
What goes in each field
ID
RequiredStable identifier, prefixed by module.
Test case
RequiredWhat is being verified, in one line.
Type
Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.
Priority
Risk based. Anything that lets a file execute, escape its directory, exhaust storage or be read by the wrong user is High. Upload is where attacker controlled bytes enter your system.
Test data
The specific values, including the invalid and boundary ones.
Expected result
RequiredThe precise observable outcome, including message text where the wording itself is the requirement.
Rename a script and upload it
Upload is an ordinary feature with an extraordinary risk profile: it stores files you did not write and often serves them to other people.
Lie about the type
Rename a script to .png and send it. Validation by extension or declared content type is the single most common upload defect.
Try the SVG case
An SVG with an inline script is an image to your validator and executable markup to a browser rendering it inline.
Pull the network cable
Interrupt at fifty per cent. A file that appears complete but is truncated is worse than a visible failure.
Guess a storage URL
Sequential or predictable object URLs on a public bucket expose every file, whatever the interface shows.
Where upload defects actually are
Type validation is the centre of gravity. The accept attribute on the input and the declared content type in the request are both supplied by the client and both trivially forged. The only reliable check inspects the file content itself, and it should refuse a mismatch between content and extension rather than trusting either alone.
Serving matters as much as accepting. Even a correctly identified file becomes dangerous if it is served inline from your primary domain with a guessable URL. The safer pattern is a separate domain for user content, an explicit content type, a download disposition for anything that does not need to render, and signed URLs with an expiry.
Interrupted transfers produce the most confusing support tickets. A truncated file that looks complete in a listing will fail later, during processing or when a customer downloads it, far from the upload that caused it. Test interruption and resume specifically, and assert byte identical downloads.
Two cases teams almost never write: metadata and deletion. Photographs carry GPS coordinates, so publishing them unstripped can expose a home address. And deletion that removes the database record while leaving bytes retrievable through a CDN is not deletion, which matters directly for data subject requests.
Suggest an improvementUploads in a regulated product?
QAble tests upload paths including content validation, storage authorisation and the privacy behaviour of stored files.
Security testing servicesMore test case sets
View allTest cases for a login page
Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.Test cases for a registration form
Test cases28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.Test cases for search functionality
Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.Test cases for a shopping cart
Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.Test cases for checkout and payment
Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.Test cases for forgot password
Test cases26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.Test cases for OTP verification
Test cases26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.Test cases for user roles and permissions
Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.Test cases for form validation
Test cases27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.Test cases for a date picker
Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.Test cases for pagination
Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.Test cases for push notifications
Test cases26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.Test cases for reports and data export
Test cases25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.Test cases for a chatbot
Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.Sources
- OWASP Web Security Testing Guide test procedures for enumeration, injection and authorisation.
- OWASP Top 10 the risk categories these security cases map to.
- OWASP ASVS verification requirements for authentication, session and access control.
Want the upload path tested like an attack surface?
QAble covers functional and security paths together with ISTQB-certified engineers. Start with a free QA audit of your product.