security: disable JavaScript in WebViews loading static content

lib/app/features/authentication/presentation/sign_in/privacy_policy/privacy_policy_page.dart

@@ -22,7 +22,7 @@ class PrivacyPolicyPage extends StatelessWidget {
       ),
       body: WebViewWidget(
         controller: WebViewController()
-          ..setJavaScriptMode(JavaScriptMode.unrestricted)
+          ..setJavaScriptMode(JavaScriptMode.disabled)
           ..loadRequest(baseUrl.resolve('web/politica-privacidade')),
       ),
     );

lib/app/features/authentication/presentation/sign_in/terms_of_use/terms_of_use_page.dart

@@ -22,7 +22,7 @@ class TermsOfUsePage extends StatelessWidget {
       ),
       body: WebViewWidget(
         controller: WebViewController()
-          ..setJavaScriptMode(JavaScriptMode.unrestricted)
+          ..setJavaScriptMode(JavaScriptMode.disabled)
           ..loadRequest(baseUrl.resolve('web/termos-de-uso')),
       ),
     );

lib/app/features/main_menu/presentation/pages/about_penhas_page.dart

@@ -23,7 +23,7 @@ class AboutPenhasPage extends StatelessWidget {
       ),
       body: WebViewWidget(
         controller: WebViewController()
-          ..setJavaScriptMode(JavaScriptMode.unrestricted)
+          ..setJavaScriptMode(JavaScriptMode.disabled)
           ..setNavigationDelegate(NavigationDelegate(
             onNavigationRequest: (request) {
               if (request.url.startsWith('mailto')) {

test/app/features/authentication/presentation/mocks/webview_mocks.dart

@@ -3,10 +3,15 @@ import 'package:webview_flutter_platform_interface/webview_flutter_platform_inte
 
 /// Fake implementation of WebViewPlatform for testing.
 class FakeWebViewPlatform extends WebViewPlatform {
+  /// The last controller created by this platform, useful for asserting
+  /// configuration values (e.g. JavaScriptMode) set during widget build.
+  FakeWebViewController? lastController;
+
   @override
   PlatformWebViewController createPlatformWebViewController(
       PlatformWebViewControllerCreationParams params) {
-    return FakeWebViewController(params);
+    lastController = FakeWebViewController(params);
+    return lastController!;
   }
 
   @override
@@ -21,6 +26,9 @@ class FakeWebViewController extends PlatformWebViewController {
   FakeWebViewController(PlatformWebViewControllerCreationParams params)
       : super.implementation(params);
 
+  /// Captures the last JavaScriptMode set, enabling test assertions.
+  JavaScriptMode? lastJavaScriptMode;
+
   @override
   Future<void> loadRequest(LoadRequestParams params) async {
     // Mock the behavior when loadRequest is called.
@@ -31,7 +39,7 @@ class FakeWebViewController extends PlatformWebViewController {
 
   @override
   Future<void> setJavaScriptMode(JavaScriptMode javaScriptMode) async {
-    // Simulate setting JavaScript mode.
+    lastJavaScriptMode = javaScriptMode;
   }
 
   @override
@@ -43,6 +51,12 @@ class FakeWebViewController extends PlatformWebViewController {
   Future<void> enableZoom(bool enabled) async {
     // Simulate enabling/disabling zoom.
   }
+
+  @override
+  Future<void> setPlatformNavigationDelegate(
+      PlatformNavigationDelegate handler) async {
+    // Simulate setting navigation delegate (needed by AboutPenhasPage).
+  }
 }
 
 /// Fake WebView Widget

test/app/features/authentication/presentation/sign_in/privacy_policy/privacy_policy_page_test.dart

@@ -1,3 +1,4 @@
+import 'package:flutter/material.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:penhas/app/features/authentication/presentation/sign_in/privacy_policy/privacy_policy_page.dart';
 import 'package:webview_flutter/webview_flutter.dart';
@@ -24,5 +25,27 @@ void main() {
         ),
       );
     });
+
+    testWidgets('should configure WebView with JavaScript disabled',
+        (tester) async {
+      final fakePlatform = FakeWebViewPlatform();
+      WebViewPlatform.instance = fakePlatform;
+
+      await tester.pumpWidget(
+        MaterialApp(
+          home: PrivacyPolicyPage(
+            baseUrl: Uri(
+              scheme: 'https',
+              host: 'www.example.com',
+            ),
+          ),
+        ),
+      );
+
+      expect(
+        fakePlatform.lastController?.lastJavaScriptMode,
+        equals(JavaScriptMode.disabled),
+      );
+    });
   });
 }

test/app/features/authentication/presentation/sign_in/terms_of_use/terms_of_use_page_test.dart

@@ -1,3 +1,4 @@
+import 'package:flutter/material.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:penhas/app/features/authentication/presentation/sign_in/terms_of_use/terms_of_use_page.dart';
 import 'package:webview_flutter/webview_flutter.dart';
@@ -24,5 +25,27 @@ void main() {
         ),
       );
     });
+
+    testWidgets('should configure WebView with JavaScript disabled',
+        (tester) async {
+      final fakePlatform = FakeWebViewPlatform();
+      WebViewPlatform.instance = fakePlatform;
+
+      await tester.pumpWidget(
+        MaterialApp(
+          home: TermsOfUsePage(
+            baseUrl: Uri(
+              scheme: 'https',
+              host: 'www.example.com',
+            ),
+          ),
+        ),
+      );
+
+      expect(
+        fakePlatform.lastController?.lastJavaScriptMode,
+        equals(JavaScriptMode.disabled),
+      );
+    });
   });
 }

test/app/features/main_menu/presentation/pages/about_penhas_page_test.dart

@@ -0,0 +1,50 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:penhas/app/features/main_menu/presentation/pages/about_penhas_page.dart';
+import 'package:webview_flutter/webview_flutter.dart';
+
+import '../../../../../utils/golden_tests.dart';
+import '../../../../features/authentication/presentation/mocks/webview_mocks.dart';
+
+void main() {
+  setUp(() {
+    WebViewPlatform.instance = FakeWebViewPlatform();
+  });
+
+  group(AboutPenhasPage, () {
+    group('golden test', () {
+      screenshotTest(
+        'looks as expected',
+        fileName: 'about_penhas_page',
+        pageBuilder: () => AboutPenhasPage(
+          baseUrl: Uri(
+            scheme: 'https',
+            host: 'www.example.com',
+          ),
+        ),
+      );
+    });
+
+    testWidgets('should configure WebView with JavaScript disabled',
+        (tester) async {
+      final fakePlatform = FakeWebViewPlatform();
+      WebViewPlatform.instance = fakePlatform;
+
+      await tester.pumpWidget(
+        MaterialApp(
+          home: AboutPenhasPage(
+            baseUrl: Uri(
+              scheme: 'https',
+              host: 'www.example.com',
+            ),
+          ),
+        ),
+      );
+
+      expect(
+        fakePlatform.lastController?.lastJavaScriptMode,
+        equals(JavaScriptMode.disabled),
+      );
+    });
+  });
+}