Parser differentials
Two parsers often disagree. Record what the edge accepts, what the app stores, and what a later viewer renders, using a harmless file you created.
Tags: parser, upload, content-type, logic
Checklist
- Type sources: Declared content type, extension, and sniffed type. Note which one the proxy, the app, and the viewer each use.
- Duplicate fields: Repeated content type, filename, or JSON keys. Record which value is stored and which value is ignored.
- Container paths: Zip, office, and image containers you built. Names inside the archive should stay inside the import area. Use a benign nested name, not an exploit file.
- Limit disagreement: Size and count limits at the proxy versus the worker. A file the edge accepts and the worker still processes is the note.
- Decode order: Charset, compression, and transfer encoding. A decode that happens on only one path changes what the next parser sees.
- Schema looseness: Extra fields, duplicate keys, and comments. Compare what a strict reader drops with what a loose reader keeps.
- Later render: Markdown, HTML, SVG, or PDF stored now and displayed later. The viewer context is the result, not the upload response alone.
- Benign files only: Use files you created. Do not upload malware, exploit documents, or samples aimed at parser memory safety.