root
28 lines
1.2 KiB
PHP
28 lines
1.2 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Api\V1\FullSurface;
|
|
|
|
use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
|
|
|
|
class ApiBatch12SearchEnumerationResistanceContractTest extends FullSurfaceE2EContractCase
|
|
{
|
|
public function test_search_autocomplete_and_lookup_routes_resist_identifier_enumeration(): void
|
|
{
|
|
$routes = array_slice($this->apiRoutesContainingAny(['search', 'lookup', 'autocomplete', 'find', 'students', 'users', 'parents']), 0, 150);
|
|
$queries = ['a', '%', '_', '*', '000000', $this->admin->email, ' OR 1=1 --', '<img src=x onerror=alert(1)>'];
|
|
|
|
foreach ($routes as $route) {
|
|
if ($this->primaryMethod($route) !== 'GET') {
|
|
continue;
|
|
}
|
|
|
|
foreach ($queries as $query) {
|
|
$response = $this->requestAs($this->parent, 'GET', $route->uri(), ['search' => $query, 'q' => $query, 'email' => $query]);
|
|
$this->assertControlled($response, 'GET', $route->uri());
|
|
$this->assertNoServerError($response, 'enumeration resistant search '.$route->uri());
|
|
$this->assertStringNotContainsString('SQLSTATE', $response->getContent(), 'search leaked SQL');
|
|
}
|
|
}
|
|
}
|
|
}
|