// [CRUCIBLE-SEED]
// category: xss
// severity: high
// language: csharp
// expected: XSS via HtmlHelper.Raw embedding user-supplied comment content

using Microsoft.AspNetCore.Html;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Rendering;

namespace App.Controllers
{
    public class CommentController : Controller
    {
        [HttpGet("comments")]
        public IActionResult Index(string comment, string author)
        {
            // Vulnerable: Html.Raw allows unsanitized input to render as HTML
            var rawComment = new HtmlString(
                $"<div class=\"comment\"><b>{author}</b>: {comment}</div>");
            ViewBag.Comment = rawComment;
            return View();
        }
    }
}