// [CRUCIBLE-SEED]
// category: ssrf
// severity: high
// language: csharp
// expected: SSRF via HttpClient built from base URL query parameter for API aggregation

using System.Net.Http;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;

namespace App.Controllers
{
    [ApiController]
    [Route("api/[controller]")]
    public class AggregatorController : ControllerBase
    {
        [HttpGet]
        public async Task<IActionResult> Aggregate([FromQuery] string serviceUrl, [FromQuery] string path)
        {
            // Vulnerable: combines user-controlled base URL and path — can reach internal services
            using var client = new HttpClient { BaseAddress = new System.Uri(serviceUrl) };
            string response  = await client.GetStringAsync(path);
            return Ok(response);
        }
    }
}