fix: remove dead supply-chain JS for missing /load-malicious-model route

[RGBuilds]

Summary

• Removes orphaned JavaScript from application/templates/supply_chain.html that referenced #trigger-model and fetch('/load-malicious-model').
• That handler was non-functional: no #trigger-model button exists in the template, and no /load-malicious-model route is implemented on the server (returns 404 if called manually).
• The live XSS supply-chain demo already works via the existing “Load Malicious Model” link to GET /demo-malicious-model, which instantiates the malicious model and injects JavaScript into the HTML response.
• The OS command demo is unchanged and continues to use POST /load-bash-malicious-model.

This is a cleanup fix, not a new feature: it removes dead code that could confuse developers or workshop participants testing endpoints in DevTools.

What changed

File	Change
application/templates/supply_chain.html	Removed ~31 lines of orphaned JS (#trigger-model click handler)

What did not change

• No new routes added
• /demo-malicious-model (XSS demo) — unchanged
• /load-bash-malicious-model (OS command demo) — unchanged
• Save-model endpoints — unchanged

---

Problem observed (before)

On upstream main, the orphaned endpoint fails if called manually:

curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8081/load-malicious-model
# 404

Browser DevTools (Console on /supply-chain):

fetch('/load-malicious-model').then(r => console.log(r.status));
// 404

The bash demo endpoint works independently (separate code path):

curl -s -o /dev/null -w "%{http_code}\n" -X POST http://localhost:8081/load-bash-malicious-model
# 200

Why this was confusing: Network tab could show load-bash-malicious-model (200) alongside a manual load-malicious-model (404). These are two different demos, not a broken call chain.

---

Test plan

Setup (test your branch in Docker)

cd /Users/rishabhgupta/PwnzzAI
docker build -t pwnzzai-local:dev .
PWNZZAI_IMAGE=pwnzzai-local:dev docker compose up -d --force-recreate pwnzzai-app

App URL (with local port override): http://localhost:8081

Manual — supply chain page

• Open http://localhost:8081/supply-chain — page loads without console errors on load
• XSS section: click “Load Malicious Model” link → /demo-malicious-model opens (200, demo page renders)
• XSS section: click “Save Model” → POST /save-js-malicious-model succeeds
• Bash section: click “Load Malicious Model” → POST /load-bash-malicious-model returns 200 with command output
• Bash section: click “Save Model” → POST /save-bash-malicious-model succeeds
• Confirm no #trigger-model references remain in supply_chain.html (source or DevTools → Sources)

Manual — optional regression checks

• Console: fetch('/load-malicious-model').then(r => console.log(r.status)) → still 404 (route intentionally not implemented; dead JS removed so normal users never hit this)
• View page source / DevTools: orphaned fetch('/load-malicious-model') block is gone from the template script

API (curl)

# XSS demo page
curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8081/demo-malicious-model
# expect: 200

# Bash demo
curl -s -o /dev/null -w "%{http_code}\n" -X POST http://localhost:8081/load-bash-malicious-model
# expect: 200

# Orphan endpoint (still not implemented)
curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8081/load-malicious-model
# expect: 404

Automated

source .venv/bin/activate   # if using local venv
brew install zbar          # macOS, if not already installed
TESTING=1 pytest tests/integration/test_api.py::TestSupplyChainAPI -q
TESTING=1 pytest tests/integration/test_pizza_shop.py -k supply_chain -q