DEV Community

build996
build996

Posted on

My upload verified byte-exact, then the host re-encoded it three seconds later

#php #hosting #webdev #devops

I deployed a PHP app with about 1,500 book covers to a free host, and my deploy script did the sensible thing: upload, read each file back, compare. Every file matched. The deploy passed.

The covers were a different size the next time I looked.

Not corrupted, not missing — re-encoded. The host runs uploaded images back through GD and writes the result over your file. You can see it in the JPEG comment:

$ curl -s https://yourhost/covers/1.jpg | strings | grep -i creator
CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85
Enter fullscreen mode Exit fullscreen mode

The part that actually cost me time is that it is asynchronous. Right after the transfer the file is byte-identical to what I sent:

$ curl -s -o a.jpg https://yourhost/covers/1.jpg && sleep 5 \
  && curl -s -o b.jpg https://yourhost/covers/1.jpg && cmp a.jpg b.jpg
a.jpg b.jpg differ: byte 3, line 1
Enter fullscreen mode Exit fullscreen mode

At t+2s, cmp was silent. By t+5s it wasn't. So a deploy that verifies immediately — which is the only sane time to verify — passes, and is wrong seconds later. Nothing in the panel or the docs mentions this.

Sizes, measured on the same set of files:

format change after rewrite
JPEG +24%
PNG +9%
GIF −6%

Dimensions are preserved. 25 MB of covers became about 30 MB, which matters on a free plan where the disk quota is the binding constraint and the panel's usage figures lag by a long way anyway.

It is worth saying that this is probably not a compression feature gone wrong. Bytes appended after the JPEG EOI marker get deleted, which is exactly what you would do to kill polyglot payloads — a JPEG that is also a PHP file stops being one. Read that way it is a reasonable defence that nobody told you about.

Two things I would take away. First, if your deploy verification runs at t+0, it is not verifying the state your visitors get; sleep first, or re-check later. Second, this is a property of the platform, not the brand — the two hosts I tested that sit on iFastNet both do it, and the two on ZETTA leave files completely alone, which is a useful reminder that four free-host brands can be two actual companies.

The four hosts, which brand runs on which platform, and the FTP and MySQL traps on each: https://toolfreebie.com/tools/free-php-hosting-tested/

Top comments (0)