Merge pull request 'gitleak validation' (#28) from apresentacao into main

Reviewed-on: #28

backend/server.js

@@ -13,31 +13,18 @@ app.use(cors());
 app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 
+
+
 // Serve a pasta frontend
 app.use(express.static(path.join(__dirname, '../frontend'), { extensions: ['html'] }));
 
-// Rotas das 4 páginas estáticas
+// Rotas das páginas estáticas (A rota '/' original foi comentada para não dar conflito com a do ZAP)
-app.get('/', (req, res) => res.sendFile(path.join(__dirname, '../frontend/index.html')));
+// app.get('/', (req, res) => res.sendFile(path.join(__dirname, '../frontend/index.html'))); 
 app.get('/about', (req, res) => res.sendFile(path.join(__dirname, '../frontend/about.html')));
 app.get('/careers', (req, res) => res.sendFile(path.join(__dirname, '../frontend/careers.html')));
 app.get('/contact', (req, res) => res.sendFile(path.join(__dirname, '../frontend/contact.html')));
 
-// ==========================================
+// O eval() FOI REMOVIDO DAQUI PARA O SONARQUBE NÃO BLOQUEAR!
-// VULNERÁVEL (OWASP ZAP)
-// ==========================================
-/*app.get('/api/search', (req, res) => {
-    const termo = req.query.q || '';
-    // A vulnerabilidade crítica: devolver o input diretamente no HTML
-    res.send(`
-        <html>
-            <head><title>Resultados</title></head>
-            <body>
-                <h1>Resultados para: ${termo}</h1>
-                <a href="/">Voltar</a>
-            </body>
-        </html>
-    `);
-});*/
 
 // Configuração do transporte de E-mail (Mocks de teste vs Produção)
 let transporter;

frontend/index.html

@@ -36,7 +36,7 @@
                     <span class="block text-blue-600">Modern website-secure</span>
                 </h1>
                 <p class="mt-6 max-w-2xl text-lg text-gray-500 leading-relaxed">
-                    At Apex Solutions, we deliver high-quality business consulting, technology services, and strategic insights. We help organizations across the globe achieve their goals through operational excellence and digital transformation.
+                    ISTEC - ERSI
                 </p>
                 <div class="mt-10 flex gap-4">
                     <a href="#services" class="px-8 py-3 border border-transparent text-base font-medium rounded-md text-white bg-blue-600 hover:bg-blue-700">Explore Services</a>

package-lock.json

@@ -11,7 +11,6 @@
       "dependencies": {
         "cors": "^2.8.5",
         "express": "^4.18.2",
-        "lodash": "4.17.15",
         "nodemailer": "^8.0.11"
       },
       "devDependencies": {
@@ -1308,9 +1307,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1325,9 +1321,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1342,9 +1335,6 @@
         "loong64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1359,9 +1349,6 @@
         "loong64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1376,9 +1363,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1393,9 +1377,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1410,9 +1391,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1427,9 +1405,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1444,9 +1419,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1461,9 +1433,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3900,12 +3869,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/lodash": {
-      "version": "4.17.15",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz",
-      "integrity": "sha512-8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A==",
-      "license": "MIT"
-    },
     "node_modules/lru-cache": {
       "version": "5.1.1",
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",

package.json

@@ -18,6 +18,7 @@
     "cors": "^2.8.5",
     "express": "^4.18.2",
     "nodemailer": "^8.0.11"
+
   },
   "devDependencies": {
     "jest": "^30.4.2",

tests/core.test.js

@@ -36,15 +36,6 @@ describe('Enterprise Application Flow & API Validation', () => {
             expect(response.status).toBe(404);
         });
 
-        /*//  OWASP ZAP (/api/search)
-        it('Should reflect the search query in the HTML response (/api/search) - Vulnerable to XSS', async () => {
-            const maliciousPayload = '<script>alert("ZAP")</script>';
-            const response = await request(app).get(`/api/search?q=${maliciousPayload}`);
-            
-            expect(response.status).toBe(200);
-            // Verifica se o payload é refletido exatamente como entrou (confirmando a vulnerabilidade)
-            expect(response.text).toContain(`Resultados para: ${maliciousPayload}`);
-        });*/
     });
 
     // ==========================================