// [CRUCIBLE-SEED]
// category: ssrf
// severity: high
// language: csharp
// expected: SSRF via HttpClient.GetAsync with user-controlled endpoint URL

using System.Net.Http;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;

namespace App.Controllers
{
    [ApiController]
    [Route("api/[controller]")]
    public class WebhookTestController : ControllerBase
    {
        private static readonly HttpClient _httpClient = new HttpClient();

        [HttpPost]
        public async Task<IActionResult> Test([FromQuery] string webhookUrl, [FromBody] string payload)
        {
            // Vulnerable: attacker can target internal metadata endpoints
            var response = await _httpClient.PostAsync(
                webhookUrl,
                new StringContent(payload, System.Text.Encoding.UTF8, "application/json"));
            string body = await response.Content.ReadAsStringAsync();
            return Ok(body);
        }
    }
}