From 853f78608824fd0f9692d6f63b5d32504b5ee356 Mon Sep 17 00:00:00 2001
From: TUNG-YEN <fisher8966@as.edu.tw>
Date: Mon, 9 Nov 2026 08:41:05 +0800
Subject: [PATCH] Clear the Checkmarx critical and high findings from the 11/09
 scan

The scan of main (123cfb2) reported one critical Stored XSS and one high
Client DOM XSS from AJAX:

- tests/e2e/lib/Cdp.php put the raw CDP handshake response into an
  exception message. It now reports a fixed message instead.
- frontend/AdminLTE3_ComVer/js/main.js defined changeBlock(), which wrote
  an AJAX response straight into the DOM. Nothing calls it (UrlModal uses
  its own changeBlockUrlModal), so it is removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                         |  1 +
 frontend/AdminLTE3_ComVer/js/main.js | 57 ----------------------------
 tests/e2e/lib/Cdp.php                |  3 +-
 3 files changed, 3 insertions(+), 58 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 93bc612..9e596b0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -43,6 +43,7 @@
 * 附件上傳改以副檔名對 MIME 對照表檢查實際內容，偽造副檔名的檔案仍會被擋
 * 附件檔名在後台列表與投票說明頁輸出時跳脫 HTML
 * 刪除投票時，照片與附件目錄須經 `voteDir()` 驗證才移除
+* 移除 `AdminLTE3_ComVer/js/main.js` 未使用的 `changeBlock()`（以 AJAX 回應直接寫入 DOM）；E2E 工具的 CDP 連線失敗訊息不再帶出對端回應內容（Checkmarx 白箱掃描嚴重／高風險各 1 項）
 
 ### Fixed
 
diff --git a/frontend/AdminLTE3_ComVer/js/main.js b/frontend/AdminLTE3_ComVer/js/main.js
index 6fac739..59abf35 100644
--- a/frontend/AdminLTE3_ComVer/js/main.js
+++ b/frontend/AdminLTE3_ComVer/js/main.js
@@ -64,63 +64,6 @@ jQuery(function ($)
 
 /* 共用的 function */
 
-/**
- * 從網址更新區塊
- *
- * 範例:
- *
- * ```js
- * changeBlock( '#example', 'https://www.example.com/');
- * ```
- *
- * @param {string} Id  更換區塊的ID
- * @param {string} Url 由網址內容更新區塊
- * @param {string|null} LoadingText 更新區塊前，加載的文字
- * @param {bool} aSync 是否使用異步
- */
-function changeBlock( Id, Url, LoadingText=null, aSync=true)
-{
-    if(!LoadingText)
-    {
-        LoadingText = '<div class="d-flex justify-content-center"><div class="spinner-border" role="status"><span class="sr-only">Loading...</span></div></div>';
-    }
-    $.ajax({
-        type: 'get',
-        url: Url,
-        async: aSync,
-        dataType: 'html',
-        beforeSend: function() {
-            // setting a timeout
-            $(Id).html(LoadingText);
-        },
-        success: function(newPartialView) {
-            $(Id).html(newPartialView);
-            $('[data-toggle="tooltip"]').tooltip();
-        },
-        error: function (jqXHR, exception) {
-            let msg = '';
-            if (jqXHR.status === 0) {
-                msg = 'Not connect.<br>Verify Network.';
-            } else if (jqXHR.status == 404) {
-                msg = 'Requested page not found. [404]';
-            } else if (jqXHR.status == 500) {
-                msg = 'Internal Server Error [500].';
-            } else if (exception === 'parsererror') {
-                msg = 'Requested JSON parse failed.';
-            } else if (exception === 'timeout') {
-                msg = 'Time out error.';
-            } else if (exception === 'abort') {
-                msg = 'Ajax request aborted.';
-            } else {
-                msg = 'Uncaught Error.<br>' + jqXHR.responseText;
-            }
-            let msgAlert = '<div class="alert alert-danger" role="alert">'+msg+'</div>';
-            let msgDiv = '<div class="d-flex justify-content-center">'+msgAlert+'</div>';
-            $(Id).html(msgDiv);
-        },
-    });
-}
-
 /**
  * 等待多少毫秒(千分之一秒)
  *
diff --git a/tests/e2e/lib/Cdp.php b/tests/e2e/lib/Cdp.php
index fbca899..78fa6b6 100644
--- a/tests/e2e/lib/Cdp.php
+++ b/tests/e2e/lib/Cdp.php
@@ -33,7 +33,8 @@ public function __construct($wsUrl)
             $resp .= $c;
         }
         if (strpos($resp, ' 101 ') === false) {
-            throw new RuntimeException("CDP handshake 失敗：$resp");
+            // 不把對端回應內容放進例外訊息（Checkmarx Stored XSS）
+            throw new RuntimeException('CDP handshake 失敗：未收到 101 Switching Protocols');
         }
     }