From a6a7f3b0b5d73db7b08e529e9e5a8751c68b5d7e Mon Sep 17 00:00:00 2001
From: pm <pedro.maio@each-cs.com>
Date: Tue, 16 Jun 2026 01:24:40 +0100
Subject: [PATCH] All Good Validation

---
 backend/server.js  | 24 ------------------------
 tests/core.test.js |  9 ---------
 2 files changed, 33 deletions(-)

diff --git a/backend/server.js b/backend/server.js
index d8e6c92..322a9d7 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -22,31 +22,7 @@ app.get('/about', (req, res) => res.sendFile(path.join(__dirname, '../frontend/a
 app.get('/careers', (req, res) => res.sendFile(path.join(__dirname, '../frontend/careers.html')));
 app.get('/contact', (req, res) => res.sendFile(path.join(__dirname, '../frontend/contact.html')));
 
-// ==========================================
-// VULNERÁVEL (OWASP ZAP)
-// ==========================================
-/*app.get('/api/search', (req, res) => {
-    const termo = req.query.q || '';
-    // A vulnerabilidade crítica: devolver o input diretamente no HTML
-    res.send(`
-        <html>
-            <head><title>Resultados</title></head>
-            <body>
-                <h1>Resultados para: ${termo}</h1>
-                <a href="/">Voltar</a>
-            </body>
-        </html>
-    `);
-});*/
 
-app.get('/api/calculate', (req, res) => {
-    const mathExpression = req.query.expr || '2+2';
-    
-    // VULNERABILIDADE CRÍTICA: O eval() executa qualquer código cego que o utilizador envie
-    const result = eval(mathExpression); 
-    
-    res.json({ result: result });
-});
 
 // Configuração do transporte de E-mail (Mocks de teste vs Produção)
 let transporter;
diff --git a/tests/core.test.js b/tests/core.test.js
index f55a0bc..359428e 100644
--- a/tests/core.test.js
+++ b/tests/core.test.js
@@ -36,15 +36,6 @@ describe('Enterprise Application Flow & API Validation', () => {
             expect(response.status).toBe(404);
         });
 
-        //  OWASP ZAP (/api/search)
-       /* it('Should reflect the search query in the HTML response (/api/search) - Vulnerable to XSS', async () => {
-            const maliciousPayload = '<script>alert("ZAP")</script>';
-            const response = await request(app).get(`/api/search?q=${maliciousPayload}`);
-            
-            expect(response.status).toBe(200);
-            // Verifica se o payload é refletido exatamente como entrou (confirmando a vulnerabilidade)
-            expect(response.text).toContain(`Resultados para: ${maliciousPayload}`);
-        });*/
     });
 
     // ==========================================