// [CRUCIBLE-SEED]
// category: xss
// severity: medium
// language: csharp
// expected: XSS via Response.Write injecting user input into JavaScript variable

using System.Web;

namespace App.Handlers
{
    public class UserDataHandler : IHttpHandler
    {
        public bool IsReusable => false;

        public void ProcessRequest(HttpContext context)
        {
            string userId   = context.Request.QueryString["uid"];
            string redirect = context.Request.QueryString["next"];
            context.Response.ContentType = "text/html";
            // Vulnerable: userId and redirect injected into inline JS
            context.Response.Write("<script>");
            context.Response.Write("var userId = \"" + userId + "\";");
            context.Response.Write("var nextUrl = \"" + redirect + "\";");
            context.Response.Write("window.location = nextUrl;");
            context.Response.Write("</script>");
        }
    }
}