From 5805011296bd1e01c828ded828d879feb282ca23 Mon Sep 17 00:00:00 2001
From: pm <pedro.maio@each-cs.com>
Date: Sat, 13 Jun 2026 10:25:25 +0100
Subject: [PATCH] owasp zap config v9

---
 .gitea/workflows/deploy.yml         | 12 ++++++-----
 backend/server.js                   | 31 ++++++++++++++++-------------
 zap-baseline.conf => zap-rules.conf |  0
 3 files changed, 24 insertions(+), 19 deletions(-)
 rename zap-baseline.conf => zap-rules.conf (100%)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 9b43079..0109dda 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -62,17 +62,19 @@ jobs:
           mkdir -p qatests
           docker volume create zap-data
           
-          # A MAGIA ACONTECE AQUI: Escrevemos o ficheiro de configuração diretamente no volume!
-          docker run --rm -v zap-data:/zap/wrk alpine sh -c 'echo "FAIL_ON_SEVERITY: HIGH" > /zap/wrk/zap-baseline.conf'
+          # Mudei o nome para zap-rules.conf (já não estamos a fazer baseline)
+          docker run --rm -v zap-data:/zap/wrk alpine sh -c 'echo "FAIL_ON_SEVERITY: HIGH" > /zap/wrk/zap-rules.conf'
           
-          echo ">>> 4. Executar OWASP ZAP..."
+          echo ">>> 4. Executar OWASP ZAP (FULL SCAN + AJAX SPIDER)..."
+          # AQUI: zap-full-scan.py em vez de zap-baseline.py!
           docker run --user root --name zap-scanner \
             --network zap-net \
             -v zap-data:/zap/wrk/:rw \
-            -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
+            -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
             -t http://apex-sandbox:3000 \
             -r report.html \
-            -I -c zap-baseline.conf || true
+            -j \
+            -I -c zap-rules.conf || true
             
           echo ">>> 5. Recolher o relatório HTML..."
           docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true
diff --git a/backend/server.js b/backend/server.js
index 029f8e0..abcaa8e 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -23,19 +23,6 @@ app.get('/about', (req, res) => res.sendFile(path.join(__dirname, '../frontend/a
 app.get('/careers', (req, res) => res.sendFile(path.join(__dirname, '../frontend/careers.html')));
 app.get('/contact', (req, res) => res.sendFile(path.join(__dirname, '../frontend/contact.html')));
 
-// Rota de Pesquisa Vulnerável a Reflected XSS (Armadilha para o OWASP ZAP)
-app.get('/api/search', (req, res) => {
-    const termoPesquisa = req.query.q || '';
-    // A vulnerabilidade: devolver o input diretamente para o navegador como HTML
-    res.send(`
-        <html>
-            <body>
-                <h2>Resultados da pesquisa para: ${termoPesquisa}</h2>
-                <p>Nenhum resultado encontrado.</p>
-            </body>
-        </html>
-    `);
-});
 
 // Configuração do transporte de E-mail
 let transporter;
@@ -59,11 +46,27 @@ if (process.env.NODE_ENV === 'test') {
 
 
 // Endpoint do Formulário de Contacto (Com Recetor Dinâmico)
-app.post('/api/contact', async (req, res) => {
+/*app.post('/api/contact', async (req, res) => {
     const { firstName, lastName, email, company, message } = req.body;
 
     if (!email || !message) {
         return res.status(400).json({ error: 'Email and message are required.' });
+    }*/
+
+app.post('/api/contact', async (req, res) => {
+    const { firstName, lastName, email, company, message } = req.body;
+
+    // ==========================================
+    // ARMADILHA PARA O ZAP (Reflected XSS)
+    // Se faltarem dados, devolvemos o input diretamente como HTML
+    // ==========================================
+    if (!email || !message) {
+        res.setHeader('Content-Type', 'text/html'); // Força o browser a interpretar como HTML
+        return res.status(400).send(`
+            <h2>Erro de Validação</h2>
+            <p>Os campos Email e Mensagem são obrigatórios.</p>
+            <p>Nome recebido: ${firstName}</p> 
+        `); 
     }
 
     try {
diff --git a/zap-baseline.conf b/zap-rules.conf
similarity index 100%
rename from zap-baseline.conf
rename to zap-rules.conf