// [CRUCIBLE-SEED]
// category: xss
// severity: medium
// language: java
// expected: XSS via setAttribute building HTML string with user input

import java.io.*;
import javax.servlet.http.*;

public class BadgeServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String label = req.getParameter("label");
        String color = req.getParameter("color");
        resp.setContentType("text/html");
        PrintWriter out = resp.getWriter();
        // Vulnerable: color and label injected into style/text attributes
        String html = "<span style=\"background-color:" + color +
                      "; padding:4px; border-radius:3px;\">" + label + "</span>";
        out.println("<html><body>" + html + "</body></html>");
    }
}