From 7c7a2efd615773a5e5bd0a95bc8117c9fd74754a Mon Sep 17 00:00:00 2001 From: pm Date: Sat, 13 Jun 2026 10:29:03 +0100 Subject: [PATCH] owasp zap config v10 --- tests/core.test.js | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/tests/core.test.js b/tests/core.test.js index 3a94203..18a6f8c 100644 --- a/tests/core.test.js +++ b/tests/core.test.js @@ -52,10 +52,16 @@ describe('Enterprise Application Flow & API Validation', () => { const response = await request(app).post('/api/contact').send(invalidPayload); expect(response.status).toBe(400); - expect(response.body).toHaveProperty('error', 'Email and message are required.'); + + // ========================================== + // CORREÇÃO DEVSECOPS: O servidor agora devolve HTML para a armadilha XSS! + // Lemos o response.text (HTML) em vez do response.body (JSON) + // ========================================== + expect(response.text).toContain('Erro de Validação'); + expect(response.text).toContain('John'); // Garante que o input foi refletido na página (a vulnerabilidade XSS) }); -it('Should process request, return 200 OK, and invoke SMTP transporter with valid data', async () => { + it('Should process request, return 200 OK, and invoke SMTP transporter with valid data', async () => { const validPayload = { firstName: 'Jane', lastName: 'Doe', @@ -70,7 +76,6 @@ it('Should process request, return 200 OK, and invoke SMTP transporter with vali expect(response.status).toBe(200); // Validate Business Logic: Verifica o objeto 'transporter' que veio do server.js - // Como este objeto é o que injetámos no server, ele já é o mock! expect(transporter.sendMail).toHaveBeenCalledTimes(1); }); });