diff --git a/core/modules/rest/src/Tests/RESTFileValidationTest.php b/core/modules/rest/src/Tests/RESTFileValidationTest.php
new file mode 100644
index 0000000..46e596a
--- /dev/null
+++ b/core/modules/rest/src/Tests/RESTFileValidationTest.php
@@ -0,0 +1,266 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\rest\Tests\RESTFileValidationTest.
+ */
+
+namespace Drupal\rest\Tests;
+
+use Drupal\Component\Serialization\Json;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\node\Entity\Node;
+use Drupal\user\RoleInterface;
+
+/**
+ * Tests the validation of files attached via REST node creation.
+ *
+ * @group rest
+ */
+class RESTFileValidationTest extends RESTTestBase {
+
+  /**
+   * Modules to install.
+   *
+   * @var array
+   */
+  public static $modules = array('hal', 'rest', 'entity_test', 'node', 'file');
+
+  /**
+   * The 'serializer' service.
+   *
+   * @var \Symfony\Component\Serializer\Serializer
+   */
+  protected $serializer;
+
+  protected function setUp() {
+    parent::setUp();
+    // Get the 'serializer' service.
+    $this->serializer = $this->container->get('serializer');
+  }
+
+  /**
+   * Tests basic file field validations when attaching to nodes.
+   */
+  public function testCreateNodeWithFile() {
+    // Create a test content type that anonymous can post..
+    $this->drupalCreateContentType(array('name' => 'Article', 'type' => 'article'));
+    $type_name = 'article';
+    $article_field_name = strtolower($this->randomMachineName());
+    $this->createFileField($article_field_name, 'node', $type_name, array('uri_scheme' => 'public'), array('file_extensions' => 'txt'));
+    // Enables the REST service for 'node' entity type.
+    $this->enableService('entity:node', 'POST');
+    $permissions = array('create article content', 'restful post entity:node');
+    user_role_grant_permissions(RoleInterface::ANONYMOUS_ID, $permissions);
+
+    $type_name = 'resttest';
+    $resttest_field_name = strtolower($this->randomMachineName());
+    $this->createFileField($resttest_field_name, 'node', $type_name, array('uri_scheme' => 'private'), array('file_extensions' => 'pdf'));
+    $permissions = array('create resttest content');
+    $account = $this->drupalCreateUser($permissions);
+    $this->drupalLogin($account);
+
+    $this->drupalLogout();
+
+    // Verify that anonymous user file uploads fail when invalid.
+    //// Populate some entity properties before creating the entity.
+    $entity_values = array('title' => $this->randomString(), 'type' => 'article');
+    $entity = Node::create($entity_values);
+
+      // Verify that user cannot create content when trying to write to fields
+      // where it is not possible.
+
+    $serialized = $this->serializer->serialize($entity, $this->defaultFormat, ['account' => $account]);
+    $this->httpRequest('entity/node', 'POST', $serialized, $this->defaultMimeType);
+    $this->assertResponse(403);
+    // Remove fields where non-administrative users cannot write.
+    $entity = $this->removeNodeFieldsForNonAdminUsers($entity);
+
+    $serialized = $this->serializer->serialize($entity, $this->defaultFormat, ['account' => $account]);
+
+  }
+
+  /**
+   * Creates a new file field.
+   *
+   * @param string $name
+   *   The name of the new field (all lowercase), exclude the "field_" prefix.
+   * @param string $entity_type
+   *   The entity type.
+   * @param string $bundle
+   *   The bundle that this field will be added to.
+   * @param array $storage_settings
+   *   A list of field storage settings that will be added to the defaults.
+   * @param array $field_settings
+   *   A list of instance settings that will be added to the instance defaults.
+   * @param array $widget_settings
+   *   A list of widget settings that will be added to the widget defaults.
+   *
+   * @return \Drupal\Core\Entity\EntityInterface
+   */
+  function createFileField($name, $entity_type, $bundle, $storage_settings = array(), $field_settings = array(), $widget_settings = array()) {
+    $field_storage = entity_create('field_storage_config', array(
+      'entity_type' => $entity_type,
+      'field_name' => $name,
+      'type' => 'file',
+      'settings' => $storage_settings,
+      'cardinality' => !empty($storage_settings['cardinality']) ? $storage_settings['cardinality'] : 1,
+    ));
+    $field_storage->save();
+
+    $this->attachFileField($name, $entity_type, $bundle, $field_settings, $widget_settings);
+    return $field_storage;
+  }
+
+  /**
+   * Attaches a file field to an entity.
+   *
+   * @param string $name
+   *   The name of the new field (all lowercase), exclude the "field_" prefix.
+   * @param string $entity_type
+   *   The entity type this field will be added to.
+   * @param string $bundle
+   *   The bundle this field will be added to.
+   * @param array $field_settings
+   *   A list of field settings that will be added to the defaults.
+   * @param array $widget_settings
+   *   A list of widget settings that will be added to the widget defaults.
+   */
+  function attachFileField($name, $entity_type, $bundle, $field_settings = array(), $widget_settings = array()) {
+    $field = array(
+      'field_name' => $name,
+      'label' => $name,
+      'entity_type' => $entity_type,
+      'bundle' => $bundle,
+      'required' => !empty($field_settings['required']),
+      'settings' => $field_settings,
+    );
+    entity_create('field_config', $field)->save();
+
+    entity_get_form_display($entity_type, $bundle, 'default')
+      ->setComponent($name, array(
+        'type' => 'file_generic',
+        'settings' => $widget_settings,
+      ))
+      ->save();
+    // Assign display settings.
+    entity_get_display($entity_type, $bundle, 'default')
+      ->setComponent($name, array(
+        'label' => 'hidden',
+        'type' => 'file_default',
+      ))
+      ->save();
+  }
+
+  /**
+   * Creates the entity over the REST API.
+   *
+   * @param string $entity_type
+   *   The type of the entity that should be created.
+   * @param string $serialized
+   *   The body for the POST request.
+   */
+  public function assertCreateEntityOverRestApi($entity_type, $serialized = NULL) {
+    // Note: this will fail with PHP 5.6 when always_populate_raw_post_data is
+    // set to something other than -1. See https://www.drupal.org/node/2456025.
+    $this->httpRequest('entity/' . $entity_type, 'POST', $serialized, $this->defaultMimeType);
+    $this->assertResponse(201);
+  }
+
+  /**
+   * Gets the new entity ID from the location header and tries to read it from
+   * the database.
+   *
+   * @param string $entity_type
+   *   Entity type we need to load the entity from DB.
+   * @param \Drupal\Core\Entity\EntityInterface $entity
+   *   The entity we want to check that was inserted correctly.
+   * @param array $entity_values
+   *   The values of $entity.
+   */
+  public function assertReadEntityIdFromHeaderAndDb($entity_type, EntityInterface $entity, array $entity_values = array()) {
+    // Get the location from the HTTP response header.
+    $location_url = $this->drupalGetHeader('location');
+    $url_parts = explode('/', $location_url);
+    $id = end($url_parts);
+
+    // Get the entity using the ID found.
+    $loaded_entity = \Drupal::entityManager()->getStorage($entity_type)->load($id);
+    $this->assertNotIdentical(FALSE, $loaded_entity, 'The new ' . $entity_type . ' was found in the database.');
+    $this->assertEqual($entity->uuid(), $loaded_entity->uuid(), 'UUID of created entity is correct.');
+
+    // Verify that the field values sent and received from DB are the same.
+    foreach ($entity_values as $property => $value) {
+      $actual_value = $loaded_entity->get($property)->value;
+      $send_value = $entity->get($property)->value;
+      $this->assertEqual($send_value, $actual_value, 'Created property ' . $property . ' expected: ' . $send_value . ', actual: ' . $actual_value);
+    }
+
+    // Delete the entity loaded from DB.
+    $loaded_entity->delete();
+  }
+
+  /**
+   * Try to send invalid data that cannot be correctly deserialized.
+   *
+   * @param string $entity_type
+   *   The type of the entity that should be created.
+   */
+  public function assertCreateEntityInvalidData($entity_type) {
+    $this->httpRequest('entity/' . $entity_type, 'POST', 'kaboom!', $this->defaultMimeType);
+    $this->assertResponse(400);
+  }
+
+  /**
+   * Try to send no data at all, which does not make sense on POST requests.
+   *
+   * @param string $entity_type
+   *   The type of the entity that should be created.
+   */
+  public function assertCreateEntityNoData($entity_type) {
+    $this->httpRequest('entity/' . $entity_type, 'POST', NULL, $this->defaultMimeType);
+    $this->assertResponse(400);
+  }
+
+  /**
+   * Send an invalid UUID to trigger the entity validation.
+   *
+   * @param \Drupal\Core\Entity\EntityInterface $entity
+   *   The entity we want to check that was inserted correctly.
+   * @param string $entity_type
+   *   The type of the entity that should be created.
+   * @param array $context
+   *   Options normalizers/encoders have access to.
+   */
+  public function assertCreateEntityInvalidSerialized(EntityInterface $entity, $entity_type, array $context = array()) {
+    // Add a UUID that is too long.
+    $entity->set('uuid', $this->randomMachineName(129));
+    $invalid_serialized = $this->serializer->serialize($entity, $this->defaultFormat, $context);
+
+    $response = $this->httpRequest('entity/' . $entity_type, 'POST', $invalid_serialized, $this->defaultMimeType);
+
+    // Unprocessable Entity as response.
+    $this->assertResponse(422);
+
+    // Verify that the text of the response is correct.
+    $error = Json::decode($response);
+    $this->assertEqual($error['error'], "Unprocessable Entity: validation failed.\nuuid.0.value: <em class=\"placeholder\">UUID</em>: may not be longer than 128 characters.\n");
+  }
+
+  /**
+   * Try to create an entity without proper permissions.
+   *
+   * @param string $entity_type
+   *   The type of the entity that should be created.
+   * @param string $serialized
+   *   The body for the POST request.
+   */
+  public function assertCreateEntityWithoutProperPermissions($entity_type, $serialized = NULL) {
+    $this->drupalLogout();
+    $this->httpRequest('entity/' . $entity_type, 'POST', $serialized, $this->defaultMimeType);
+    // Forbidden Error as response.
+    $this->assertResponse(403);
+    $this->assertFalse(\Drupal::entityManager()->getStorage($entity_type)->loadMultiple(), 'No entity has been created in the database.');
+  }
+
+}