Parser and control bypass reference

Upload Validation Boundary

Map filename, declared type, detected type, parser, storage, serving, transformation, and renderer as separate controls. Use inert files and a known cleanup path.

uploadmultipartmimeparserstorage

Stable IDbypass:upload-validationSource record date2026-08-20Human reviewNot recordedProvenanceCurated reference

Compare behaviorA bypass claim needs a control request and a clear boundary that changed.

Stop after confirmation. Do not escalate impact without separate authorization.

Filename versus detected type

Change one property at a time across paired inert files. Never upload executable server code to prove a classification disagreement.

marker.txt with text/plain
marker.jpg containing a valid inert JPEG
marker.txt renamed marker.jpg

Multipart metadata comparison

Compare filename, part Content-Type, and field name without changing the bytes. Record server normalization and any later transformation.

filename=marker.txt; Content-Type=text/plain
filename=marker.bin; Content-Type=application/octet-stream

Storage and serving boundary

Observe whether content is private, public, transformed, downloaded, or rendered. Use a unique harmless marker and remove it after testing.

unique text marker
valid 1x1 image with inert metadata
known-invalid control file

Evidence gate

A finding requires a security-relevant difference such as content rendered in an unsafe context, an authorization boundary crossed, or a dangerous parser reached. Extension acceptance alone is not enough.

paired inert files + readback + cleanup record

Version history: normalized permanent page created 2026-08-20.