ZIP archive testing for uploads and packages

Practical checklist

• Inspect the entry list before extracting anything.
• Enforce entry-count, size, and compression-ratio limits.
• Reject absolute paths and directory-traversal entries.
• Verify CRC values after extraction.

Inspect entries before extraction

List every entry with its compressed size, uncompressed size, and path before writing anything to disk. A valid PK signature only proves the file starts as a ZIP archive; it says nothing about what the entries contain or where they point.

Enforce decompression limits

Apply entry-count, total-size, and compression-ratio limits before extraction, and stop at the first violation. A small upload can expand into gigabytes, so limits must cover the extracted total, not just the uploaded bytes.

Treat Office files as ZIP packages

DOCX, XLSX, and PPTX are ZIP packages with required internal entries. Confirm [Content_Types].xml and the expected word, xl, or ppt entries before classifying an upload as a Word, spreadsheet, or presentation file.

Expected results

• Entry lists match the central directory before extraction.
• Oversized or traversal entries are rejected without writing files.
• Office uploads expose the expected package entries.

Common failure modes

• Extracting entries before validating paths.
• Limiting only the uploaded size while ignoring extracted size.
• Treating every PK signature as the same document type.

Check the fixture with curl

Download the representative file and print the response status, MIME type, and transferred byte count.

curl --fail --location --silent --show-error \
  --output sample-document.docx \
  --write-out 'status=%{http_code}\ncontent_type=%{content_type}\nbytes=%{size_download}\n' \
  'https://assets.testfiles.dev/documents/sample-document.docx'

Verify document integrity with Python Requests

Download the document and assert its MIME type, exact byte size, and SHA-256 digest before passing it to a parser or preview service.

import hashlib
import requests

url = "https://assets.testfiles.dev/documents/sample-document.docx"
response = requests.get(url, timeout=30)
response.raise_for_status()

assert "application/vnd.openxmlformats-officedocument.wordprocessingml.document" in response.headers.get("content-type", "")
assert len(response.content) == 11204
assert hashlib.sha256(response.content).hexdigest() == "c71a5f6effc5ead9f855465713c6f9874dce435d14b7d88afd3ce6f24c6c8a70"
print("Verified sample-document.docx", len(response.content), "bytes")

Node.js ZIP package check

Fetch a published DOCX fixture, confirm the PK ZIP signature, and read the entry count from the end-of-central-directory record without extracting anything.

const response = await fetch('https://assets.testfiles.dev/documents/sample-document.docx');
if (!response.ok) throw new Error('download failed');
const bytes = new Uint8Array(await response.arrayBuffer());
const isZipPackage = bytes[0] === 0x50 && bytes[1] === 0x4b && bytes[2] === 0x03 && bytes[3] === 0x04;
if (!isZipPackage) throw new Error('not a ZIP package');
let directoryOffset = -1;
for (let index = bytes.length - 22; index >= 0; index--) {
  if (bytes[index] === 0x50 && bytes[index + 1] === 0x4b && bytes[index + 2] === 0x05 && bytes[index + 3] === 0x06) {
    directoryOffset = index;
    break;
  }
}
if (directoryOffset < 0) throw new Error('missing end-of-central-directory record');
const entryCount = bytes[directoryOffset + 10] | (bytes[directoryOffset + 11] << 8);
console.log({ signature: '50 4B 03 04', byteSize: bytes.length, entryCount });

Use stable sample files

These fixtures have stable URLs, recorded MIME types, byte sizes, SHA-256 values, and dedicated detail pages.

Format references