💔 Broken files
Intentionally corrupted files for error-handling verification. Use them to test validation and error-handling logic.
A PNG file with a corrupted header
PNG / 10 KB
A PNG file truncated part-way through
PNG / 30 B
A PDF file with a corrupted header
PDF / 10 KB
A PDF file truncated part-way through
PDF / 40 B
A corrupted ZIP file
ZIP / 10 KB
A JSON file containing a syntax error
JSON / 36 B
A CSV file whose rows have inconsistent column counts
CSV / 231 B
Why testing with broken files matters
In production, files can arrive corrupted from network failures or transfer errors. Malicious users may also upload files with spoofed extensions.
Use these broken files to test that your application detects and handles errors properly — never crashing, and always returning a clear error message.
📖 Where people get stuck
Files broken on purpose: truncated part-way, header corrupted, syntactically invalid, column counts that do not line up. What they exercise is your error handling, not your security. These are the shapes corruption takes by accident, which is not the same as a file crafted by an attacker.
| Case | What happens | What to do |
|---|---|---|
| It throws, and the user is told nothing | A single broad try / catch swallows it and returns an empty result or a bare 500. The log often says no more than that something failed. |
Tell the user which file, which line, and what went wrong. Push a broken file through and look at the actual screen: judge it by whether someone could act on what it says. |
| A truncated file passes the size check | Anything under the cap passes. Nothing looks at the other end, so zero-byte and few-byte files get stored just the same. | Set a floor as well. Then check the format terminator: a PDF should end with %%EOF and a ZIP with an End of Central Directory record (50 4B 05 06) — their absence detects truncation. |
| The header is checked and the body is trusted | Correct magic bytes say nothing about what follows. The header-corrupted files here are the mirror image: the body is readable and only the first bytes are wrong. |
Validate where you actually read the file, not only at the door. Decoding an image for real, or listing a ZIP, is what settles it. |
| A CSV with mismatched columns passes silently | Most CSV parsers hand back an array per row and never check that the widths agree. Missing columns become null and are stored as they are. |
Take the header row as the reference and reject row by row with the line number attached. If the trouble is delimiters or quoting, running the file through the CSV cleaner first is quicker. |
What is modelled here is accidental corruption. Deliberately hostile inputs — zip bombs, deeply nested XML, an innocuous archive that expands to gigabytes — are not included, and they call for size and depth caps applied before anything is expanded.