root
29 lines
1.2 KiB
PHP
29 lines
1.2 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Api\V1\FullSurface;
|
|
|
|
use Tests\Feature\Api\V1\FullSurface\Support\FullSurfaceE2EContractCase;
|
|
|
|
class ApiBatch15RouteParameterPoisoningExpansionTest extends FullSurfaceE2EContractCase
|
|
{
|
|
public function test_batch15_route_parameters_reject_encoded_path_script_and_type_confusion_payloads_cleanly(): void
|
|
{
|
|
$poisoned = ['..%2F..%2F.env', '%00', '<svg/onload=alert(1)>', '1 or 1=1', str_repeat('9', 80), '٠١٢٣', 'null', '[]'];
|
|
|
|
foreach (array_slice($this->apiRoutes(), 0, 80) as $route) {
|
|
if (! str_contains($route->uri(), '{')) {
|
|
continue;
|
|
}
|
|
|
|
$method = $this->primaryMethod($route);
|
|
foreach (array_slice($poisoned, 0, 4) as $value) {
|
|
$path = '/'.preg_replace('/\{[^}]+\}/', $value, $route->uri());
|
|
$this->actingAs($this->actorFor($route->uri()), 'api');
|
|
$response = $this->json($method, $path, $this->payloadFor($method, $route->uri()));
|
|
$this->assertControlled($response, $method, $route->uri());
|
|
$this->assertStringNotContainsString('laravel.log', strtolower($response->getContent()));
|
|
}
|
|
}
|
|
}
|
|
}
|