// [CRUCIBLE-SEED]
// category: xss
// severity: high
// language: java
// expected: XSS via PrintWriter writing unescaped request parameter to response

import java.io.*;
import javax.servlet.http.*;

public class GreetingServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        resp.setContentType("text/html");
        PrintWriter out = resp.getWriter();
        String name = req.getParameter("name");
        // Vulnerable: name reflected directly into HTML without encoding
        out.println("<html><body>");
        out.println("<h1>Hello, " + name + "!</h1>");
        out.println("<p>Welcome back to our portal.</p>");
        out.println("</body></html>");
    }
}