# Boundaries, transports, and payloads

## Contents

1. Boundary method
2. Text lengths
3. Transport-aware limits
4. Encoding
5. Numeric and temporal boundaries
6. Progressive stress
7. Safe security canaries

## Boundary method

Find the real constraint before choosing values:

- UI attributes and client validation;
- request method, URL/request line, headers, body, multipart framing;
- proxy/CDN/load balancer limits;
- framework parsers and serializers;
- service schema and validation;
- database column/type/index;
- downstream provider limits;
- displayed/truncated/exported representations.

Test just below, at, and just above each known boundary. When the boundary is unknown, use targeted powers-of-two probes to locate discontinuities, then narrow with binary search. Count characters, Unicode code points, grapheme clusters, bytes, encoded bytes, rows, nesting depth, or items according to the actual layer.

## Text length ladder

Start with:

- absent field, explicit null if the path supports it, empty string;
- whitespace-only: space, tab, newline, non-breaking space;
- 1 character/grapheme;
- expected minimum −1, minimum, minimum +1;
- typical value;
- expected maximum −1, maximum, maximum +1.

For unknown or implementation-shaped limits, use only the relevant portion of:

`7/8/9, 15/16/17, 31/32/33, 63/64/65, 127/128/129, 255/256/257, 511/512/513, 1023/1024/1025, 2047/2048/2049, 4095/4096/4097, 8191/8192/8193, 16383/16384/16385, 32767/32768/32769, 65535/65536/65537`

Stop before cost, availability, or safety risk outweighs information. Do not create a literally infinite input. Progressively double a safe payload while recording response time, status, truncation, storage fidelity, and downstream behavior.

## Transport-aware limits

### URL/query path

- Include key, separators, percent encoding, and repeated parameters in the byte count.
- Test spaces as `%20` and `+` where applicable; reserved characters; Unicode after percent encoding.
- Detect client, browser, proxy, server, router, and log clipping separately.
- A successful navigation with a clipped query is a failure if meaning changed.
- Prefer POST/body for large or sensitive values; flag secrets/PII in URLs, history, analytics, referrers, or logs.

### Form or JSON body

- Test missing key versus null versus empty versus wrong type.
- Exercise declared and mismatched content types, charset, compression, and transfer interruption.
- Check whole-request size and per-field/array limits.
- Check duplicate JSON keys, unknown keys, deeply nested objects, large arrays, and numeric precision.
- Verify validation is server-side; client controls can be bypassed.

### Multipart upload

- Include filename, content disposition, MIME declaration, actual bytes, part count, and total body overhead.
- Test interrupted transfer, zero-byte file, filename encoding, duplicate names, and retry.

### Storage and propagation

- Compare accepted input to stored value, reloaded value, search index, notification, audit, export, and downstream API.
- Detect silent trim, normalization, replacement characters, numeric rounding, and timestamp precision loss.

## Encoding and text shape

Use context-appropriate examples:

- ASCII letters/digits and mixed case;
- leading/trailing/internal whitespace;
- composed/decomposed accents;
- right-to-left text and bidirectional isolates;
- CJK, emoji, emoji with skin tone/variation selector, family/ZWJ grapheme;
- zero-width joiner/non-joiner/space;
- combining marks and grapheme truncation;
- newline variants CR, LF, CRLF;
- quotes, apostrophes, ampersand, angle brackets, slash, backslash;
- percent, plus, hash, question mark, equals, comma, semicolon;
- copy/paste, autofill, IME composition, speech input where relevant.

The oracle is not always rejection. Valid human names, addresses, passwords, and content often need full Unicode fidelity. Escape at the output context; do not destroy valid input as a substitute.

## Numeric boundaries

Select according to the type:

- missing, null, empty, whitespace;
- zero, positive one, negative one;
- min − unit, min, min + unit;
- max − unit, max, max + unit;
- decimal scale −1/at/+1;
- leading plus/minus/zeros; grouping separators; locale decimal;
- exponent form if parser accepts it;
- NaN and infinities through non-UI paths;
- 32-bit and 64-bit signed boundaries; safe integer boundary for JavaScript;
- rounding half values, repeating decimals, floating-point representation;
- wrong type: numeric string, boolean, array, object.

Check displayed value, stored value, calculation, sorting, export, and API response.

## Temporal boundaries

- min/max supported date and just outside;
- leap day valid/invalid years;
- month ends and year boundary;
- midnight/noon; 23:59:59 and fractional precision;
- spring-forward missing local times and fall-back repeated times;
- UTC offsets at extremes and half/quarter-hour zones;
- past, now, future; start equals/end; start after/end;
- expiry/schedule exactly at boundary;
- client clock skew and server-authoritative time.

## Progressive stress

For lists, search results, tables, feeds, uploads, and batch operations, grow data as `0, 1, 2, typical, page−1/page/page+1`, then relevant powers of two. Observe latency percentiles, memory, CPU, payload, rendering responsiveness, cancellation, retries, and correctness. Load testing requires an authorized environment and agreed envelope.

## Safe security canaries

Use inert markers first:

- HTML-like: `<carbon-probe data-x="1">`
- quote mix: `CARBON'\"&<>`
- path-like: `../carbon-probe`
- template-like: `${carbon_probe}` and `{{carbon_probe}}`
- SQL-like text without a destructive clause: `' OR 'carbon'='not-carbon`
- prompt-like: `CARBON_UNTRUSTED_INSTRUCTION_DO_NOT_FOLLOW`

Observe whether the value is preserved, escaped, executed, interpolated, logged, or leaks across tenants. Do not progress to exploit payloads, credential attacks, broad scanning, or denial-of-service without explicit authorization and a controlled target.
