pm/website-secure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Gitleaks Validation #25

Merged
pm merged 18 commits from validation_stage into main 2026-06-16 15:34:30 +00:00
Conversation 0 Commits 18 Files Changed 3
+33 -10
1 changed files with 33 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit a213cc9482 - Show all commits
backend/server.js
+33 -10
View File
@@ -13,24 +13,24 @@ app.use(cors());
app.use(express.json());
app.use(express.urlencoded({ extended: true }));
// ==========================================
// ROTA LIMPA (Passa no SonarQube, chumba no ZAP)
// ==========================================
// Modificamos a rota principal temporariamente para o ZAP encontrar o link
// Modificamos a rota principal temporariamente para o ZAP encontrar o link e atacar
app.get('/', (req, res) => {
res.send(`
<html>
<body>
<h1>Bem-vindo a Apex Solutions</h1>
<!-- O ZAP vai encontrar este link, clicar nele e tentar injetar código -->
<a href="/api/search?q=teste">Pesquisar</a>
</body>
</html>
`);
});
// A rota vulnerável a XSS que o SonarQube ignora (por ser versão gratuita)
// A rota vulnerável a XSS que o SonarQube (versão gratuita) ignora, mas o ZAP destrói
app.get('/api/search', (req, res) => {
const termo = req.query.q || '';
// Vulnerabilidade Crítica: XSS Refletido
@@ -40,12 +40,14 @@ app.get('/api/search', (req, res) => {
// Serve a pasta frontend
app.use(express.static(path.join(__dirname, '../frontend'), { extensions: ['html'] }));
// Rotas das páginas estáticas
// app.get('/', (req, res) => res.sendFile(path.join(__dirname, '../frontend/index.html'))); // <-- COMENTADO PARA NÃO DAR CONFLITO
// Rotas das páginas estáticas (A rota '/' original foi comentada para não dar conflito com a do ZAP)
// app.get('/', (req, res) => res.sendFile(path.join(__dirname, '../frontend/index.html')));
app.get('/about', (req, res) => res.sendFile(path.join(__dirname, '../frontend/about.html')));
app.get('/careers', (req, res) => res.sendFile(path.join(__dirname, '../frontend/careers.html')));
app.get('/contact', (req, res) => res.sendFile(path.join(__dirname, '../frontend/contact.html')));
// O eval() FOI REMOVIDO DAQUI PARA O SONARQUBE NÃO BLOQUEAR!
// Configuração do transporte de E-mail (Mocks de teste vs Produção)
let transporter;
@@ -64,10 +66,11 @@ if (process.env.NODE_ENV === 'test') {
});
}
// Endpoint do Formulário de Contacto
// Endpoint do Formulário de Contacto (Com a armadilha validada pelo Jest)
app.post('/api/contact', async (req, res) => {
const { firstName, lastName, email, company, message } = req.body;
// Se faltarem dados, devolvemos HTML para simular XSS e bater com o teste unitário
if (!email || !message) {
res.setHeader('Content-Type', 'text/html');
return res.status(400).send(`
@@ -82,15 +85,35 @@ app.post('/api/contact', async (req, res) => {
from: '"Apex Solutions" <teste@limpezascleanandcare.com>',
to: email,
subject: `Confirmation: We received your request, ${firstName}!`,
html: `<p>Thank you for reaching out to Apex Solutions.</p>` // Encurtado aqui apenas para não poluir o ecrã, podes manter o teu HTML original!
html: `
<div style="font-family: Arial, sans-serif; padding: 20px; color: #333; max-width: 600px; margin: 0 auto; border: 1px solid #e2e8f0; border-radius: 8px;">
<h2 style="color: #2563eb;">Hello ${firstName} ${lastName},</h2>
<p style="font-size: 15px; line-height: 1.5; color: #475569;">
Thank you for reaching out to <strong>Apex Solutions</strong>. This is an automated confirmation.
</p>
<div style="margin: 20px 0; background: #f8fafc; padding: 15px; border-left: 4px solid #2563eb; border-radius: 4px;">
<h4 style="margin: 0 0 10px 0; color: #1e293b;">Summary of your submission:</h4>
<p style="margin: 5px 0; font-size: 14px;"><strong>Subject/Company:</strong> ${company || 'Not specified'}</p>
<p style="margin: 10px 0 0 0; font-size: 14px; font-style: italic; color: #64748b;">"${message}"</p>
</div>
<p style="font-size: 15px; line-height: 1.5; color: #475569;">
Our team will get back to you within 24 business hours.
</p>
<hr style="border: 0; border-top: 1px solid #e2e8f0; margin: 20px 0;" />
<p style="font-size: 12px; color: #94a3b8; text-align: center; margin: 0;">
Best regards,<br><strong>Apex Solutions Corporate Team</strong>
</p>
</div>
`
};
const info = await transporter.sendMail(mailOptions);
console.log(`[Email Sent] Message ID: ${info.messageId}`);
res.status(200).json({ success: true, message: 'Thank you! Email dispatched.' });
console.log(`[Email Sent Automatically to ${email}] Message ID: ${info.messageId}`);
res.status(200).json({ success: true, message: 'Thank you! A confirmation email has been dispatched.' });
} catch (error) {
console.error(`[Email Error]:`, error);
res.status(500).json({ error: 'Internal server error.' });
res.status(500).json({ error: 'Internal server error. Could not send confirmation email.' });
}
});