Magic bytes and MIME validation

Practical checklist

• Read enough leading bytes for the target signatures.
• Compare extension, declared MIME, and detected MIME.
• Inspect ZIP package entries before classifying Office files.
• Reject ambiguous or unsupported content before processing.

Use signatures as the first gate

PNG begins with an eight-byte signature, PDF with %PDF, WebM with an EBML header, WAV with RIFF plus WAVE, and MP4 or MOV exposes ftyp near the start. A signature narrows the format but may not fully validate it.

Inspect container structure

DOCX, XLSX, and PPTX all begin as ZIP packages. Confirm the content types and expected word, xl, or ppt package entries instead of classifying by extension alone. Likewise, inspect codecs inside video containers.

Handle conflicts explicitly

Define whether a mismatch is rejected, quarantined, or renamed. Log the declared and detected values without echoing unsafe filenames into HTML or exposing internal paths.

Expected results

• A renamed PDF with a .jpg extension is detected as PDF.
• DOCX, XLSX, and PPTX are distinguished by package structure.
• Unknown or truncated files are rejected before preview conversion.

Common failure modes

• Trusting File.type from the browser.
• Treating every PK ZIP signature as DOCX.
• Reading only two or three bytes for formats with offset signatures.

Check the fixture with curl

Download the representative file and print the response status, MIME type, and transferred byte count.

curl --fail --location --silent --show-error \
  --output sample-document.docx \
  --write-out 'status=%{http_code}\ncontent_type=%{content_type}\nbytes=%{size_download}\n' \
  'https://assets.testfiles.dev/documents/sample-document.docx'

Verify document integrity with Python Requests

Download the document and assert its MIME type, exact byte size, and SHA-256 digest before passing it to a parser or preview service.

import hashlib
import requests

url = "https://assets.testfiles.dev/documents/sample-document.docx"
response = requests.get(url, timeout=30)
response.raise_for_status()

assert "application/vnd.openxmlformats-officedocument.wordprocessingml.document" in response.headers.get("content-type", "")
assert len(response.content) == 11204
assert hashlib.sha256(response.content).hexdigest() == "c71a5f6effc5ead9f855465713c6f9874dce435d14b7d88afd3ce6f24c6c8a70"
print("Verified sample-document.docx", len(response.content), "bytes")

Node.js signature check

Fetch a published fixture and compare its leading bytes before passing it to an Office parser.

const response = await fetch('https://assets.testfiles.dev/documents/sample-document.docx');
if (!response.ok) throw new Error('download failed');
const bytes = new Uint8Array(await response.arrayBuffer());
const isZipPackage = bytes[0] === 0x50 && bytes[1] === 0x4b && bytes[2] === 0x03 && bytes[3] === 0x04;
if (!isZipPackage) throw new Error('not an Office ZIP package');
console.log({ declared: response.headers.get('content-type'), signature: '50 4B 03 04', byteSize: bytes.length });

Use stable sample files

These fixtures have stable URLs, recorded MIME types, byte sizes, SHA-256 values, and dedicated detail pages.

Format references