Synthetic image-link fixture: eight cases an image check must classify, and what each does to a product

The fixture

This is a synthetic worked example with invented values, not a customer case or a supplier's file. Results marked computed were produced with Python's standard library on invented input. The addresses below are placeholders for a local test server you control, not real hosts. The agreed rules in this example are a redirect limit of five hops, a time limit of ten seconds and a minimum width of 500 pixels; your agreement would set its own.

If the matrix is wider than the box, scroll horizontally to read every column. Keyboard: focus the matrix and use Left/Right.

#  case                           server returns                      class       action (hold rule)
1  working image                  200, image/jpeg, 900 px              ok          import
2  missing file                   404                                  missing     hold
3  permanent redirect to image    301 -> 200, image/png                ok          import; note final address
4  redirect loop                  302 -> 302 -> ...                    loop        hold after 5 hops
5  error page with success status 200, text/html                       not-image   hold
6  type and extension disagree    200, image/png at a .jpg address     mismatch    hold or flag, per rule
7  image too small                200, image/jpeg, 120 px              too-small   hold
8  host does not answer           no response in 10 seconds            timeout     hold; run continues

What the matrix demonstrates

Case 5 is the one a status check misses: the server says success and sends a page. Case 4 is cut off after a fixed number of hops, as the HTTP specification says a client should intervene in cyclical redirections. Case 8 must not stop the whole import. Cases 2 and 8 both leave a blank image but are different classes: a 404 is an answer from the host that the file is not there, and the specification says it does not say whether the absence is temporary or permanent, while a timeout is no answer at all. Where a host answers a metadata request differently from a real fetch, the check should fall back to a real fetch, because the specification lets a server omit fields such as Content-Length from the metadata answer.

Four destinations the check must refuse

The addresses in a supplier file are chosen by someone else, so a check that fetches them must also refuse to fetch addresses that do not belong on the public internet, or your server can be made to request its own internal services. OWASP names loopback, private-network and link-local ranges, and the cloud metadata address, among the destinations to block, and warns that following redirects can bypass a check made only on the first address. The four extra cases below are authored for the fixture; the addresses are the standard loopback, private and metadata ranges, and none of them is requested.

If the matrix is wider than the box, scroll horizontally to read every column. Keyboard: focus the matrix and use Left/Right.

#   case                          what the address points at                class     action
9   loopback address              the machine itself (127.0.0.1)            refused   hold; no request sent
10  private-network address       an address in 10.0.0.0/8                  refused   hold; no request sent
11  link-local metadata address   169.254.169.254                           refused   hold; no request sent
12  public address that           302 to http://127.0.0.1/ (checked again   refused   hold at the redirect; no request
    redirects inward              before the redirect is followed)                    reaches the target

The assertions an acceptance test should make

Assert the class of each of the eight image cases. Assert that, with the test-only setting off, each of the four refused-destination cases is reported as refused and that a listener on the loopback address logs no request. That setting, off by default, is switched on only so that the fixture's own local server can be reached for the first eight cases. Assert that a twenty-row import including the timeout case finishes inside the agreed time. Assert that every product appears in the report exactly once with its action, and that the counts of imported, held and flagged products add up to the rows read. Assert the redirect cut-off. These are authored expectations on a fixture; no supplier host was contacted.

What this example does not show

It does not show how any real supplier behaves, and a working address does not mean a shopping platform will accept the picture; Google's rules about size, overlays and placeholders are covered in the Merchant Center image guide. It does not judge image content.

Use it to specify a priced enquiry

The fixed job feed-image-url-validation-before-import is £345 for one import path and one supplier layout, tested against a local fixture like this one and an agreed sample. Send a few invented rows with the kinds of addresses that fail, and the run size, first. Prices are untested proposals, and payment follows the agreed checks and your sign-off. Nothing is booked or charged by an enquiry.