PRACTICE FIXTURE — intentionally built for automation practice
Single and multiple uploads
Native file inputs share the same server allowlist, storage quota, progress, and visible response.
No files uploaded.
File dropzone
The shared dropzone accepts drag/drop and keyboard activation, then uses the same secure upload path.
Image and CSV previews
Images preview from the local selection; CSV cells are parsed and inserted with textContent, never raw HTML.
Select an image or CSV to preview it.
Rejection paths
Client guidance mirrors the authoritative server checks; renamed scripts, HTML, active SVG, traversal names, oversize files, and quota overflow are rejected.
Allowed: PNG, JPEG, CSV, plain TXT, and PDF. Maximum size: 2 MiB each. The server returns a stable error code without storing rejected bytes.
No rejected file observed.
Static and dynamic downloads
Each response sends attachment disposition with a deterministic suggested filename.
No API-triggered download requested.