// [CRUCIBLE-SEED]
// category: xss
// severity: high
// language: java
// expected: XSS via JSON response that directly embeds user input in HTML script block

import java.io.*;
import javax.servlet.http.*;

public class ProfileServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String username    = req.getParameter("user");
        String redirectUrl = req.getParameter("next");
        resp.setContentType("text/html");
        PrintWriter out = resp.getWriter();
        // Vulnerable: user input injected into inline JS
        out.println("<script>");
        out.println("var currentUser = \"" + username + "\";");
        out.println("var nextUrl = \"" + redirectUrl + "\";");
        out.println("window.location = nextUrl;");
        out.println("</script>");
    }
}