YAML's failure modes are almost the opposite of JSON's. The syntax rarely breaks; the types do. YAML 1.1 resolves unquoted scalars implicitly, so NO becomes the boolean false, 22:22 becomes the integer 1342, and 0755 becomes 493. YAML 1.2 changed all three, and most libraries still default to 1.1 — so the spec version your parser implements silently changes your data.
That is what makes these dangerous rather than annoying. Almost nothing here raises an error. The file loads, the config looks right, and a port number is a string or a country code is a boolean. The fixtures that do fail loudly — tabs in indentation, invalid UTF-8 — are the easy ones.
- What is the Norway problem?
- Under YAML 1.1, the unquoted scalar NO resolves to the boolean false — so in a list of ISO country codes, Norway silently becomes false. YES, ON, OFF, Y and N behave the same way. YAML 1.2 narrowed booleans to true and false only, but many widely used libraries still default to 1.1, which is why the same file behaves differently depending on what is reading it.
- Most of these parse without errors — is that not the point of a test file?
- That is exactly the point. YAML's syntax rarely breaks; its implicit typing does. Almost every fixture here loads successfully and produces a value that is simply not what was written. A parser that raises an error is the good case — the dangerous one is the config that loads cleanly with a port number that became a string, or a country code that became false.
- Are these files dangerous?
- No. They are inert test files for checking your own import pipeline. Nothing here executes on its own — the fixtures that model injection or traversal exist so you can verify your own code rejects them, and the resource-exhaustion ones are deliberately scaled down so they demonstrate the behaviour without taking down the machine you are testing from.
- Why does the page show raw bytes?
- Because most of these cases are invisible in a text preview. A byte order mark renders as nothing, a bare carriage return looks identical to a CRLF, and a NUL looks like the end of the string. The hex view highlights exactly which bytes matter and explains each one when you hover it.
- Does my pass/fail progress get saved?
- Yes, in your own browser only, and separately for each format. The workflow expects you to leave the page, run a fixture through your parser, and come back — so results persist locally. Nothing is uploaded, and clearing site data clears them.
- Is this free?
- Yes. Every fixture is generated in your browser, with no signup and no upload.