// [CRUCIBLE-SEED]
// category: path_traversal
// severity: high
// language: csharp
// expected: Path traversal via FileStream opened from user-supplied config name

using System.IO;
using Microsoft.AspNetCore.Mvc;

namespace App.Controllers
{
    [ApiController]
    [Route("api/[controller]")]
    public class ConfigController : ControllerBase
    {
        private const string ConfigDir = "/etc/appservice/configs/";

        [HttpGet("{configName}")]
        public IActionResult GetConfig(string configName)
        {
            // Vulnerable: configName not validated; ../../etc/shadow possible
            string filePath = ConfigDir + configName + ".json";
            using var fs     = new FileStream(filePath, FileMode.Open, FileAccess.Read);
            using var reader = new StreamReader(fs);
            return Ok(reader.ReadToEnd());
        }
    }
}