// [CRUCIBLE-SEED]
// category: xss
// severity: high
// language: java
// expected: XSS via JSP-style out.print with unescaped error message from request

import java.io.*;
import javax.servlet.http.*;
import javax.servlet.*;

public class ErrorPageServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws IOException, ServletException {
        String errorMsg = req.getParameter("message");
        String code     = req.getParameter("code");
        resp.setContentType("text/html");
        PrintWriter out = resp.getWriter();
        // Vulnerable: both parameters written without sanitization
        out.print("<div class=\"alert alert-danger\">");
        out.print("Error " + code + ": " + errorMsg);
        out.print("</div>");
        out.print("<a href=\"/\">Return home</a>");
    }
}