Corrupt and malformed test files for error handling — free, CC0
Most test files are meant to be read successfully. These are not. Every file under edge/
is wrong on purpose, in one declared way: empty, cut short, malformed, or carrying bytes
that do not match the name and content type it is served with.
Each file is served as the type its extension claims, because that is the situation worth
testing. edge/png-with-pdf-extension.pdf arrives as application/pdf and is a PNG;
edge/zero-byte.zip arrives as application/zip with no bytes at all;
edge/pdf-truncated-60pct.pdf reads as a PDF until it stops mid-object. Sniffing the
content type from the extension, trusting a Content-Length, or assuming a parser will
raise a tidy error are all mistakes these files find.
Use them on upload forms, import pipelines, thumbnailers, virus and type scanners, and
anything that extracts an archive. edge/zip-directory-traversal-name.zip holds an entry
named ../evil.txt: an extractor that joins entry names to a destination path without
sanitising them writes outside that directory, and this file tells you whether yours does.
The files are synthetic and harmless — no executable code, no real malware — so run them
only against systems you are authorised to test. Related formats: PDF,
PNG, ZIP, JSON, CSV.
| File | Size | Properties | Description |
|---|---|---|---|
csv-ragged-rows.csv
|
65 B | A CSV whose rows carry different field counts: one short, one long.
Snippets |
|
jpg-truncated-50pct.jpg
|
7.5 KB | The first half of jpg/640x480.jpg: scan data ends with no end-of-image marker.
Snippets |
|
json-bom.json
|
80 B | Valid JSON preceded by a UTF-8 byte-order mark, which RFC 8259 does not allow.
Snippets |
|
json-trailing-comma.json
|
64 B | JSON with a trailing comma in an array and an object: valid JavaScript, invalid JSON.
Snippets |
|
mp4-truncated-50pct.mp4
|
987.3 KB | The first half of mp4/720p-5s.mp4: a partial media stream inside a box that claims more.
Snippets |
|
pdf-truncated-60pct.pdf
|
2.6 KB | The first 60% of pdf/a4-3pages.pdf: the header reads, then the file stops mid-object.
Snippets |
|
pdf-with-png-extension.png
|
1.8 KB | The bytes of pdf/a4-1page.pdf under a .png name, served as image/png.
Snippets |
|
png-with-pdf-extension.pdf
|
1.4 KB | The bytes of png/100x100.png under a .pdf name, served as application/pdf.
Snippets |
|
utf8-invalid-bytes.txt
|
143 B | Text served as UTF-8 that contains byte sequences UTF-8 does not allow.
Snippets |
|
xml-unclosed-tag.xml
|
122 B | XML with an element that is never closed, so it is not well-formed.
Snippets |
|
zero-byte.csv
|
0 B | An empty file served as text/csv, with no header row.
Snippets |
|
zero-byte.json
|
0 B | An empty file served as application/json, where a parser expects at least a value.
Snippets |
|
zero-byte.mp4
|
0 B | An empty file served as video/mp4.
Snippets |
|
zero-byte.pdf
|
0 B | An empty file served as application/pdf.
Snippets |
|
zero-byte.png
|
0 B | An empty file served as image/png.
Snippets |
|
zero-byte.txt
|
0 B | An empty file served as text/plain.
Snippets |
|
zero-byte.zip
|
0 B | An empty file served as application/zip, with not even an end-of-central-directory record.
Snippets |
|
zip-directory-traversal-name.zip
|
782 B | A readable zip holding an entry named ../evil.txt. An extractor that joins entry names to a destination without sanitising them writes outside that directory.
Snippets |
|
zip-truncated-50pct.zip
|
911 B | The first half of zip/3-text-files.zip: local headers survive, the central directory does not.
Snippets |
Related formats
File names follow the naming grammar. Verify a download against sha256sums.txt.