// [CRUCIBLE-SEED]
// category: command_injection
// severity: critical
// language: csharp
// expected: Command injection via Process.Start with user-supplied filename in ffmpeg command

using System.Diagnostics;
using Microsoft.AspNetCore.Mvc;

namespace App.Controllers
{
    [ApiController]
    [Route("api/[controller]")]
    public class ConvertController : ControllerBase
    {
        [HttpPost]
        public IActionResult Convert([FromQuery] string inputFile, [FromQuery] string outputFile)
        {
            // Vulnerable: inputFile and outputFile not sanitized before shell execution
            string cmd = $"ffmpeg -i /uploads/{inputFile} /output/{outputFile}";
            var psi = new ProcessStartInfo("/bin/sh", $"-c \"{cmd}\"")
            {
                RedirectStandardOutput = true,
                UseShellExecute        = false
            };
            using var proc = Process.Start(psi);
            proc.WaitForExit();
            return Ok($"Exit code: {proc.ExitCode}");
        }
    }
}