File upload testing covers validation, storage, security, progress and the ability to retrieve the correct file later.
On this checklist
Valid files
- Every supported extension and MIME type.
- Minimum, typical and maximum-size files.
- Uppercase extensions and mixed-case names.
- Single and multiple selection.
- Drag-and-drop and file picker.
- Content preview, metadata and processing result.
Validation
| Test | Expected |
|---|---|
| Empty file | Accepted or rejected according to requirement. |
| Maximum + 1 byte | Clear size error before unsafe processing. |
| Wrong extension | Rejected server-side. |
| Renamed content | File content and MIME type are validated, not only the name. |
| Corrupt file | Controlled error and no partial record. |
| Too many files | Count limit is enforced. |
| Duplicate | Replace, version, reject or retain behaviour is clear. |
Filenames and security
- No extension, multiple extensions and trailing dots.
- Very long name and path-like text.
- Spaces, Unicode, emoji and right-to-left text.
- Characters such as quotes, angle brackets and separators.
- Names matching an existing file.
- Executable, script, archive and macro-enabled content where relevant.
Use harmless test files: coordinate security testing and malware samples with the authorised security process. Never upload real malware casually.
Verify files are stored outside executable web paths, access is authorised, generated storage names are safe and the response does not expose internal paths.
Upload behaviour
- Progress reflects actual upload state.
- Cancel stops the request and cleans partial data.
- Network loss shows a clear error and supports safe retry.
- Refresh, back and double submit do not create unintended duplicates.
- Parallel uploads obey limits and keep correct status.
- Scanning or processing state is visible and cannot be bypassed.
- Large uploads do not freeze the page.
Download verification
- Only authorised users can view or download the file.
- Downloaded name, extension, MIME type and size are correct.
- Checksum or binary comparison matches the original when no transformation is expected.
- Transformed images or documents retain required quality and metadata rules.
- Deleted or replaced files are no longer accessible through old URLs.
- Download headers prevent unsafe inline execution where required.