From ead9faecf0cee3d70c3932350ccd3cd1f3c3f256 Mon Sep 17 00:00:00 2001
From: Rishabh Gupta <rishabhg.swe@gmail.com>
Date: Sat, 1 Aug 2026 23:17:35 -0700
Subject: [PATCH] fix: remove dead supply-chain JS for missing
 /load-malicious-model route

The XSS section handler referenced #trigger-model and fetch('/load-malicious-model'),
but no trigger button exists in the template and the route was never implemented.
The live XSS demo already uses /demo-malicious-model; this orphaned code was non-functional.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 application/templates/supply_chain.html | 31 -------------------------
 1 file changed, 31 deletions(-)

diff --git a/application/templates/supply_chain.html b/application/templates/supply_chain.html
index 3c68e54..a0377b0 100644
--- a/application/templates/supply_chain.html
+++ b/application/templates/supply_chain.html
@@ -248,37 +248,6 @@ <h3>Operational Security</h3>
     
     <script>
         document.addEventListener('DOMContentLoaded', function() {
-            // Get the button element
-            const triggerButton = document.getElementById('trigger-model');
-            
-            // Add click event listener for XSS demo button
-            if (triggerButton) {
-                triggerButton.addEventListener('click', function() {
-                    // Show loading message
-                    document.getElementById('vuln-demo-result').innerHTML = 
-                        '<p>Creating an instance of the malicious model...</p>';
-                    
-                    // Make a request to load the model
-                    fetch('/load-malicious-model')
-                        .then(response => response.json())
-                        .then(data => {
-                            // Check if the response contains the JavaScript payload
-                            if (data.js_payload) {
-                                // Execute the JavaScript by injecting it into the page
-                                // In a real supply chain attack, this would happen automatically
-                                const scriptContainer = document.createElement('div');
-                                scriptContainer.innerHTML = data.js_payload;
-                                document.body.appendChild(scriptContainer);
-                            }
-                        })
-                        .catch(error => {
-                            console.error('Error loading model:', error);
-                            document.getElementById('vuln-demo-result').innerHTML = 
-                                '<div class="alert alert-danger">Error loading the model. Check the console for details.</div>';
-                        });
-                });
-            }
-
             // Add click event listener for bash command execution demo
             const bashButton = document.getElementById('load-bash-model');
             if (bashButton) {