From 414ebd29ad53f279aa27eb4732f66420a3a3f915 Mon Sep 17 00:00:00 2001
From: pm <pedro.maio@each-cs.com>
Date: Tue, 16 Jun 2026 01:12:10 +0100
Subject: [PATCH] SonarQube Validation v4

---
 backend/server.js | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/backend/server.js b/backend/server.js
index 499cc37..d8e6c92 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -23,9 +23,9 @@ app.get('/careers', (req, res) => res.sendFile(path.join(__dirname, '../frontend
 app.get('/contact', (req, res) => res.sendFile(path.join(__dirname, '../frontend/contact.html')));
 
 // ==========================================
-// VULNERÁVEL (OWASP ZAP) / SonarQube
+// VULNERÁVEL (OWASP ZAP)
 // ==========================================
-app.get('/api/search', (req, res) => {
+/*app.get('/api/search', (req, res) => {
     const termo = req.query.q || '';
     // A vulnerabilidade crítica: devolver o input diretamente no HTML
     res.send(`
@@ -37,6 +37,15 @@ app.get('/api/search', (req, res) => {
             </body>
         </html>
     `);
+});*/
+
+app.get('/api/calculate', (req, res) => {
+    const mathExpression = req.query.expr || '2+2';
+    
+    // VULNERABILIDADE CRÍTICA: O eval() executa qualquer código cego que o utilizador envie
+    const result = eval(mathExpression); 
+    
+    res.json({ result: result });
 });
 
 // Configuração do transporte de E-mail (Mocks de teste vs Produção)