File Formats — Headers, Envelopes & Containers
Every upload, download, attachment, and asset pipeline crosses these layers. Misunderstanding header vs envelope causes MIME spoofing bugs, parser differentials, and broken file validation. Start here before diving into individual format specs.
What It Defines
Conceptual model for how binary and text files are structured: file type identification (extension, MIME, magic bytes), fixed vs variable headers, payloads, footers/indexes, container formats (ZIP, MP4, PDF), transport envelopes (multipart, JSON wrappers, crypto envelopes), framing (length-prefixed, TLV), and metadata layers (filesystem, header, embedded EXIF, protocol envelope). The transport format and the file format are independent — a PNG stays valid after its HTTP or messaging envelope is removed.
Canonical (Normative)
Convenient (Practical)
Related References
Authoritative registry for protocol parameters: ports, HTTP status codes, media types, DNS record types, and many other code points. Not a spec body — a registry body.
Related Specs
Correct Content-Type headers drive content negotiation, browser rendering, and API behavior. Wrong types cause security and parsing bugs.
Every file upload in your app uses this. Know the MIME boundary, Content-Disposition, and Content-Type mechanics to build and debug file upload APIs.
Extension spoofing (`virus.exe` → `photo.jpg`) and MIME spoofing are common attack vectors. Magic-byte detection is the first line of defense in upload validation, antivirus, and content sniffing.
JSON cannot carry raw binary; Base64 is how file bytes appear in API responses, data URLs, PEM blocks, and JWT segments. Know the difference between standard Base64 and Base64url.
PNG is the default lossless image format on the web — screenshots, UI assets, icons with transparency, and OCR-friendly graphics. Chunk structure matters for metadata stripping and security review.
PDF is the standard for invoices, reports, contracts, and printable documents. Object/stream structure, encryption, and embedded content matter for parsing, redaction, and security review.
ZIP is everywhere — downloads, backups, Java JARs, Office Open XML. Central-directory-at-end structure, path traversal (`../../`), and zip bombs are critical security concerns.
MP4 is the dominant video container on the web and in MSE players. Box hierarchy, codec vs container distinction, and fragmenting (fMP4 for HLS/DASH) are essential for media engineering.
XML remains embedded in enterprise integrations, document formats, and legacy APIs. Namespaces, entity expansion (XXE), and DTD processing are security-critical in parsers.
YAML configs power most DevOps tooling. Anchor/alias and implicit typing cause subtle bugs — know why `countries: [NO, US]` parses as `[false, null]` in YAML 1.1.
CBOR is the binary envelope behind COSE cryptographic messages and many constrained-device protocols. Typed length-prefixed encoding without a schema — unlike Protobuf.
OOXML is the dominant enterprise document format. Every `.docx` is a ZIP you can unzip — knowing the part layout enables templating, mail-merge, and malware scanning.
DASH is the open-standard counterpart to HLS for adaptive video. MPD manifest structure + fMP4 segment layout is how Netflix-style streaming works outside the Apple ecosystem.
HLS is the dominant streaming format for live and VOD on Apple devices, CDNs, and most broadcast workflows. M3U8 text manifest + segmented media is the canonical chunked-file envelope pattern.
WAV is the universal file format for call recordings, IVR prompts, voicemail exports, and PSTN debug captures. Every telephony platform (Twilio, Asterisk, FreeSWITCH) reads and writes WAV-wrapped G.711.
3GP is the standard container for mobile-recorded video/voice messages, MMS media, and legacy carrier content. Shares ISO BMFF box structure with MP4 but restricted codec set.
Opus-in-Ogg is an alternative to WebM/MP4 for VoIP recordings and Icecast streams. Page/chunk structure is a classic telephony streaming envelope pattern.