Define the exercise boundary

Write down the receiving endpoint, storage boundary, allowed type and maximum size, and who can inspect the result. Use a harmless test file; do not upload customer records, executable content, or information whose retention is unclear.

OWASP's File Upload Cheat Sheet describes constraints on type, size, storage, and handling. It does not prove a particular application has implemented those controls.

Exercise an allow and a reject path

Upload the approved synthetic file and record its identity, visible result, storage location, access boundary, and cleanup decision. Then use an explicitly disallowed type or oversized harmless fixture. Record the visible failure and whether any unexpected object was retained.

The evidence packet includes an upload-exercise worksheet. It is a planning and review aid, not a security assessment or malware scan.

Verification checklist

  • The exercise uses an approved non-production endpoint and harmless file.
  • An accepted and rejected case have recorded outcomes.
  • Storage, access, retention, and cleanup owners are known.
  • The reviewer knows what the exercise did not test.

For a broader exposure exercise, see Test an Internal App Against Company-Data Exposure and test application notifications.