// [CRUCIBLE-SEED]
// category: deserialization
// severity: critical
// language: csharp
// expected: Unsafe deserialization via JsonConvert with TypeNameHandling.All on user input

using Newtonsoft.Json;
using Microsoft.AspNetCore.Mvc;

namespace App.Controllers
{
    [ApiController]
    [Route("api/[controller]")]
    public class DataController : ControllerBase
    {
        [HttpPost("load")]
        public IActionResult Load([FromBody] string json)
        {
            // Vulnerable: TypeNameHandling.All allows attacker to specify arbitrary type
            var settings = new JsonSerializerSettings
            {
                TypeNameHandling = TypeNameHandling.All
            };
            object result = JsonConvert.DeserializeObject(json, settings);
            return Ok(result?.GetType().Name);
        }
    }
}