// [CRUCIBLE-SEED]
// category: deserialization
// severity: critical
// language: csharp
// expected: Unsafe deserialization via DataContractSerializer reading from request body

using System.Runtime.Serialization;
using System.Xml;
using Microsoft.AspNetCore.Mvc;

namespace App.Controllers
{
    [ApiController]
    [Route("api/[controller]")]
    public class OrderController : ControllerBase
    {
        [HttpPost("import")]
        public IActionResult Import()
        {
            // Vulnerable: DataContractSerializer resolves types from XML — SSRF/RCE risk
            var serializer = new DataContractSerializer(typeof(object));
            using var reader = XmlReader.Create(Request.Body);
            object order = serializer.ReadObject(reader);
            return Ok("Imported: " + order?.GetType().Name);
        }
    }
}