From 50607610671a444cb40effba8c2ac9597e3e3384 Mon Sep 17 00:00:00 2001
From: tiagobento10 <1201087@isep.ipp.pt>
Date: Sat, 20 Apr 2024 00:44:10 +0100
Subject: [PATCH] docs: use case 3 threat modeling missing only abuse cases

---
 .../Phase1/Use Case 3/US 3 - Threat Tree.svg  |  4 ++
 .../Use Case 3 - Threat Modeling.md           | 44 +++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 Deliverables/Phase1/Use Case 3/US 3 - Threat Tree.svg
 create mode 100644 Deliverables/Phase1/Use Case 3/Use Case 3 - Threat Modeling.md

diff --git a/Deliverables/Phase1/Use Case 3/US 3 - Threat Tree.svg b/Deliverables/Phase1/Use Case 3/US 3 - Threat Tree.svg
new file mode 100644
index 00000000..62d45c1c
--- /dev/null
+++ b/Deliverables/Phase1/Use Case 3/US 3 - Threat Tree.svg	
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Do not edit this file with editors other than draw.io -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="781px" height="341px" viewBox="-0.5 -0.5 781 341" content="&lt;mxfile host=&quot;app.diagrams.net&quot; modified=&quot;2024-04-19T23:12:53.464Z&quot; agent=&quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36&quot; etag=&quot;QNlEUl_W_LF_v2JM2hyo&quot; version=&quot;21.4.0&quot; type=&quot;device&quot;&gt;&#10;  &lt;diagram id=&quot;C5RBs43oDa-KdzZeNtuy&quot; name=&quot;Page-1&quot;&gt;&#10;    &lt;mxGraphModel dx=&quot;1434&quot; dy=&quot;738&quot; grid=&quot;1&quot; gridSize=&quot;10&quot; guides=&quot;1&quot; tooltips=&quot;1&quot; connect=&quot;1&quot; arrows=&quot;1&quot; fold=&quot;1&quot; page=&quot;1&quot; pageScale=&quot;1&quot; pageWidth=&quot;827&quot; pageHeight=&quot;1169&quot; math=&quot;0&quot; shadow=&quot;0&quot;&gt;&#10;      &lt;root&gt;&#10;        &lt;mxCell id=&quot;WIyWlLk6GJQsqaUBKTNV-0&quot; /&gt;&#10;        &lt;mxCell id=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-0&quot; /&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-2&quot; value=&quot;&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;&quot; edge=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot; source=&quot;XgY4lxPiN6GVmBq9-WwZ-0&quot; target=&quot;XgY4lxPiN6GVmBq9-WwZ-1&quot;&gt;&#10;          &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-4&quot; value=&quot;&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;&quot; edge=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot; source=&quot;XgY4lxPiN6GVmBq9-WwZ-0&quot; target=&quot;XgY4lxPiN6GVmBq9-WwZ-3&quot;&gt;&#10;          &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot;&gt;&#10;            &lt;Array as=&quot;points&quot;&gt;&#10;              &lt;mxPoint x=&quot;410&quot; y=&quot;280&quot; /&gt;&#10;              &lt;mxPoint x=&quot;660&quot; y=&quot;280&quot; /&gt;&#10;            &lt;/Array&gt;&#10;          &lt;/mxGeometry&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-7&quot; value=&quot;&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;&quot; edge=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot; source=&quot;XgY4lxPiN6GVmBq9-WwZ-0&quot; target=&quot;XgY4lxPiN6GVmBq9-WwZ-6&quot;&gt;&#10;          &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot;&gt;&#10;            &lt;Array as=&quot;points&quot;&gt;&#10;              &lt;mxPoint x=&quot;410&quot; y=&quot;280&quot; /&gt;&#10;              &lt;mxPoint x=&quot;120&quot; y=&quot;280&quot; /&gt;&#10;            &lt;/Array&gt;&#10;          &lt;/mxGeometry&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-0&quot; value=&quot;Atacante pode tirar proveito da barra de pesquisa de produtos&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#f5f5f5;fontColor=#333333;strokeColor=#666666;&quot; vertex=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot;&gt;&#10;          &lt;mxGeometry x=&quot;350&quot; y=&quot;190&quot; width=&quot;120&quot; height=&quot;60&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-13&quot; value=&quot;&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;&quot; edge=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot; source=&quot;XgY4lxPiN6GVmBq9-WwZ-1&quot; target=&quot;XgY4lxPiN6GVmBq9-WwZ-12&quot;&gt;&#10;          &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-1&quot; value=&quot;&amp;lt;font color=&amp;quot;#000000&amp;quot;&amp;gt;Injetar código SQL na barra de pesquisa, aproveitando-se de falhas de validação ou sanitização&amp;lt;/font&amp;gt;&quot; style=&quot;whiteSpace=wrap;html=1;fillColor=#ffe6cc;strokeColor=#d79b00;rounded=0;&quot; vertex=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot;&gt;&#10;          &lt;mxGeometry x=&quot;320&quot; y=&quot;330&quot; width=&quot;180&quot; height=&quot;60&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-15&quot; value=&quot;&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;&quot; edge=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot; source=&quot;XgY4lxPiN6GVmBq9-WwZ-3&quot; target=&quot;XgY4lxPiN6GVmBq9-WwZ-14&quot;&gt;&#10;          &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-3&quot; value=&quot;&amp;lt;font color=&amp;quot;#000000&amp;quot;&amp;gt;Inserir scripts maliciosos, comprometendo a segurança do sistema ou roubando informações confidenciais dos utilizadores&amp;lt;/font&amp;gt;&quot; style=&quot;whiteSpace=wrap;html=1;fillColor=#ffe6cc;strokeColor=#d79b00;rounded=0;&quot; vertex=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot;&gt;&#10;          &lt;mxGeometry x=&quot;550&quot; y=&quot;330&quot; width=&quot;240&quot; height=&quot;60&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-11&quot; value=&quot;&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;&quot; edge=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot; source=&quot;XgY4lxPiN6GVmBq9-WwZ-6&quot; target=&quot;XgY4lxPiN6GVmBq9-WwZ-10&quot;&gt;&#10;          &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot;&gt;&#10;            &lt;Array as=&quot;points&quot;&gt;&#10;              &lt;mxPoint x=&quot;120&quot; y=&quot;450&quot; /&gt;&#10;              &lt;mxPoint x=&quot;120&quot; y=&quot;450&quot; /&gt;&#10;            &lt;/Array&gt;&#10;          &lt;/mxGeometry&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-6&quot; value=&quot;&amp;lt;font color=&amp;quot;#000000&amp;quot;&amp;gt;Sobrecarregar o sistema com uma grande quantidade de solicitações de pesquisa maliciosas, tornando-o lento ou indisponível&amp;lt;/font&amp;gt;&quot; style=&quot;whiteSpace=wrap;html=1;fillColor=#ffe6cc;strokeColor=#d79b00;rounded=0;&quot; vertex=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot;&gt;&#10;          &lt;mxGeometry x=&quot;20&quot; y=&quot;330&quot; width=&quot;220&quot; height=&quot;60&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-10&quot; value=&quot;&amp;lt;font color=&amp;quot;#000000&amp;quot;&amp;gt;Implementar mecanismos de controlo de tráfego para limitar o número de solicitações que um único utilizador pode fazer num determinado período de tempo&amp;lt;/font&amp;gt;&quot; style=&quot;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;rounded=0;&quot; vertex=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot;&gt;&#10;          &lt;mxGeometry x=&quot;10&quot; y=&quot;470&quot; width=&quot;240&quot; height=&quot;60&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-12&quot; value=&quot;&amp;lt;font color=&amp;quot;#000000&amp;quot;&amp;gt;Implementar validação&amp;amp;nbsp;dos dados de entrada&amp;lt;/font&amp;gt;&quot; style=&quot;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;rounded=0;&quot; vertex=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot;&gt;&#10;          &lt;mxGeometry x=&quot;350&quot; y=&quot;470&quot; width=&quot;120&quot; height=&quot;60&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;XgY4lxPiN6GVmBq9-WwZ-14&quot; value=&quot;&amp;lt;font color=&amp;quot;#000000&amp;quot;&amp;gt;Aplicar filtragem de entrada para remover caracteres especiais e evitar a execução de scripts maliciosos&amp;lt;/font&amp;gt;&quot; style=&quot;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;rounded=0;&quot; vertex=&quot;1&quot; parent=&quot;WIyWlLk6GJQsqaUBKTNV-1&quot;&gt;&#10;          &lt;mxGeometry x=&quot;560&quot; y=&quot;470&quot; width=&quot;220&quot; height=&quot;60&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;      &lt;/root&gt;&#10;    &lt;/mxGraphModel&gt;&#10;  &lt;/diagram&gt;&#10;&lt;/mxfile&gt;&#10;"><defs/><g><path d="M 400 60 L 400 133.63" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 400 138.88 L 396.5 131.88 L 400 133.63 L 403.5 131.88 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/><path d="M 400 60 L 400 90 L 650 90 L 650 133.63" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 650 138.88 L 646.5 131.88 L 650 133.63 L 653.5 131.88 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/><path d="M 400 60 L 400 90 L 110 90 L 110 133.63" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 110 138.88 L 106.5 131.88 L 110 133.63 L 113.5 131.88 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/><rect x="340" y="0" width="120" height="60" fill="#f5f5f5" stroke="#666666" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 118px; height: 1px; padding-top: 30px; margin-left: 341px;"><div data-drawio-colors="color: #333333; " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(51, 51, 51); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;">Atacante pode tirar proveito da barra de pesquisa de produtos</div></div></div></foreignObject><text x="400" y="34" fill="#333333" font-family="Helvetica" font-size="12px" text-anchor="middle">Atacante pode tirar...</text></switch></g><path d="M 400 200 L 400 273.63" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 400 278.88 L 396.5 271.88 L 400 273.63 L 403.5 271.88 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/><rect x="310" y="140" width="180" height="60" fill="#ffe6cc" stroke="#d79b00" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 178px; height: 1px; padding-top: 170px; margin-left: 311px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;"><font color="#000000">Injetar código SQL na barra de pesquisa, aproveitando-se de falhas de validação ou sanitização</font></div></div></div></foreignObject><text x="400" y="174" fill="rgb(0, 0, 0)" font-family="Helvetica" font-size="12px" text-anchor="middle">Injetar código SQL na barra de...</text></switch></g><path d="M 660 200 L 660 273.63" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 660 278.88 L 656.5 271.88 L 660 273.63 L 663.5 271.88 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/><rect x="540" y="140" width="240" height="60" fill="#ffe6cc" stroke="#d79b00" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 238px; height: 1px; padding-top: 170px; margin-left: 541px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;"><font color="#000000">Inserir scripts maliciosos, comprometendo a segurança do sistema ou roubando informações confidenciais dos utilizadores</font></div></div></div></foreignObject><text x="660" y="174" fill="rgb(0, 0, 0)" font-family="Helvetica" font-size="12px" text-anchor="middle">Inserir scripts maliciosos, comprometend...</text></switch></g><path d="M 110 200 L 110 260 L 110 273.63" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 110 278.88 L 106.5 271.88 L 110 273.63 L 113.5 271.88 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/><rect x="10" y="140" width="220" height="60" fill="#ffe6cc" stroke="#d79b00" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 218px; height: 1px; padding-top: 170px; margin-left: 11px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;"><font color="#000000">Sobrecarregar o sistema com uma grande quantidade de solicitações de pesquisa maliciosas, tornando-o lento ou indisponível</font></div></div></div></foreignObject><text x="120" y="174" fill="rgb(0, 0, 0)" font-family="Helvetica" font-size="12px" text-anchor="middle">Sobrecarregar o sistema com uma gran...</text></switch></g><rect x="0" y="280" width="240" height="60" fill="#d5e8d4" stroke="#82b366" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 238px; height: 1px; padding-top: 310px; margin-left: 1px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;"><font color="#000000">Implementar mecanismos de controlo de tráfego para limitar o número de solicitações que um único utilizador pode fazer num determinado período de tempo</font></div></div></div></foreignObject><text x="120" y="314" fill="rgb(0, 0, 0)" font-family="Helvetica" font-size="12px" text-anchor="middle">Implementar mecanismos de controlo de tr...</text></switch></g><rect x="340" y="280" width="120" height="60" fill="#d5e8d4" stroke="#82b366" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 118px; height: 1px; padding-top: 310px; margin-left: 341px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;"><font color="#000000">Implementar validação dos dados de entrada</font></div></div></div></foreignObject><text x="400" y="314" fill="rgb(0, 0, 0)" font-family="Helvetica" font-size="12px" text-anchor="middle">Implementar validaçã...</text></switch></g><rect x="550" y="280" width="220" height="60" fill="#d5e8d4" stroke="#82b366" pointer-events="all"/><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 218px; height: 1px; padding-top: 310px; margin-left: 551px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;"><font color="#000000">Aplicar filtragem de entrada para remover caracteres especiais e evitar a execução de scripts maliciosos</font></div></div></div></foreignObject><text x="660" y="314" fill="rgb(0, 0, 0)" font-family="Helvetica" font-size="12px" text-anchor="middle">Aplicar filtragem de entrada para re...</text></switch></g></g><switch><g requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"/><a transform="translate(0,-5)" xlink:href="https://www.drawio.com/doc/faq/svg-export-text-problems" target="_blank"><text text-anchor="middle" font-size="10px" x="50%" y="100%">Text is not SVG - cannot display</text></a></switch></svg>
\ No newline at end of file
diff --git a/Deliverables/Phase1/Use Case 3/Use Case 3 - Threat Modeling.md b/Deliverables/Phase1/Use Case 3/Use Case 3 - Threat Modeling.md
new file mode 100644
index 00000000..a602e20c
--- /dev/null
+++ b/Deliverables/Phase1/Use Case 3/Use Case 3 - Threat Modeling.md	
@@ -0,0 +1,44 @@
+# Threat Modeling para "Ver e Filtrar uma Lista de Produtos"
+
+## Determinar Ameaças
+
+### Lista de Ameaças STRIDE
+
+| Tipo                   | Descrição                                                                                                                 | Controlo de Segurança |
+|------------------------|---------------------------------------------------------------------------------------------------------------------------|-----------------------|
+| Spoofing               | Ação de ameaça destinada a aceder e usar credenciais de outro utilizador, como nome de utilizador e palavra-passe.        | Autenticação          |
+| Tampering              | Ação de ameaça com a intenção de alterar ou modificar maliciosamente dados persistentes.                                  | Integridade           |
+| Repudiation            | Ação de ameaça destinada a realizar operações proibidas num sistema que não possui a capacidade de rastrear as operações. | Não Repúdio           |
+| Information Disclosure | Ação de ameaça com a intenção de ler um ficheiro ao qual não foi concedido acesso, ou ler dados em trânsito.              | Confidencialidade     |
+| Denial of Service      | Ação de ameaça que tenta negar acesso a utilizadores válidos.                                                             | Disponibilidade       |
+| Elevation of Privilege | Ação de ameaça com a intenção de obter acesso privilegiado a recursos.                                                    | Autorização           |
+
+## Análise de Ameaças
+
+### Compreensão das Ameaças
+
+- **(Denial Of Service)** Sobrecarregar o sistema com uma grande quantidade de solicitações de pesquisa maliciosas, tornando-o lento ou indisponível.
+- **(Tampering)** Injetar código SQL na barra de pesquisa, aproveitando-se de falhas de validação ou sanitização.
+- **(Spoofing/Tampering)** Inserir scripts maliciosos, comprometendo a segurança do sistema ou roubando informações confidenciais dos utilizadores.
+
+
+### Casos de Uso e Abuso
+
+
+
+## Contramedidas e Mitigação
+
+| Tipo de Ameaça                                      | Técnicas de Mitigação                                                                                                                | Critério de ameaça  |
+|-----------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|---------------------|
+| Sobrecarga do sistema com solicitações maliciosas   | 1. Implementar rate limiting ou throttling para limitar o número de solicitações por utilizador.                                     | Totalmente Mitigada |
+|                                                     | 2. Utilizar serviços de proteção contra ataques DDoS para detectar e mitigar ataques em larga escala.                                | Totalmente Mitigada |
+|                                                     |                                                                                                                                      |                     |
+| Injeção de código SQL na barra de pesquisa          | 1. Utilizar prepared statements ou consultas parametrizadas para evitar a execução de comandos SQL não autorizados.                  | Totalmente Mitigada |
+|                                                     | 2. Implementar validação e sanitização rigorosas dos dados de entrada para garantir que apenas caracteres válidos sejam aceites.     | Totalmente Mitigada |
+|                                                     |                                                                                                                                      |                     |
+| Inserção de scripts maliciosos na barra de pesquisa | 1. Aplicar filtragem de entrada para remover caracteres especiais e evitar a execução de scripts maliciosos.                         | Totalmente Mitigada |
+|                                                     | 2. Implementar Content Security Policy (CSP) no lado do servidor para restringir o tipo de conteúdo executável em uma página da web. | Totalmente Mitigada |
+
+## Threat Tree
+
+![US 3 - Threat Tree.svg](US%203%20-%20Threat%20Tree.svg)
\ No newline at end of file