add test batches

tests/Feature/Api/V1/FullSurface/ApiBatch15RouteParameterPoisoningExpansionTest.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Tests\Feature\Api\V1\FullSurface;
+
+use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
+
+class ApiBatch15RouteParameterPoisoningExpansionTest extends FullSurfaceE2EContractCase
+{
+
+    public function test_batch15_route_parameters_reject_encoded_path_script_and_type_confusion_payloads_cleanly(): void
+    {
+        $poisoned = ['..%2F..%2F.env', '%00', '<svg/onload=alert(1)>', '1 or 1=1', str_repeat('9', 80), '٠١٢٣', 'null', '[]'];
+
+        foreach (array_slice($this->apiRoutes(), 0, 80) as $route) {
+            if (! str_contains($route->uri(), '{')) {
+                continue;
+            }
+
+            $method = $this->primaryMethod($route);
+            foreach (array_slice($poisoned, 0, 4) as $value) {
+                $path = '/' . preg_replace('/\{[^}]+\}/', $value, $route->uri());
+                $this->actingAs($this->actorFor($route->uri()), 'api');
+                $response = $this->json($method, $path, $this->payloadFor($method, $route->uri()));
+                $this->assertControlled($response, $method, $route->uri());
+                $this->assertStringNotContainsString('laravel.log', strtolower($response->getContent()));
+            }
+        }
+    }
+
+}