// [CRUCIBLE-SEED]
// category: path_traversal
// severity: high
// language: csharp
// expected: Path traversal via Path.Combine without verifying result stays within base directory

using System.IO;
using Microsoft.AspNetCore.Mvc;

namespace App.Controllers
{
    [ApiController]
    [Route("api/[controller]")]
    public class TemplateController : ControllerBase
    {
        private const string TemplateRoot = "/var/app/templates/";

        [HttpGet]
        public IActionResult GetTemplate([FromQuery] string name)
        {
            // Vulnerable: Path.Combine does not prevent traversal if name starts with /
            string path    = Path.Combine(TemplateRoot, name);
            byte[] content = File.ReadAllBytes(path);
            return File(content, "text/html");
        }
    }
}