// [CRUCIBLE-SEED]
// category: command_injection
// severity: critical
// language: java
// expected: Command injection via Runtime.exec with user-supplied filename

import java.io.*;
import javax.servlet.http.*;

public class FileProcessorServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String filename = req.getParameter("filename");
        // Vulnerable: filename injected into shell command via Runtime.exec
        String cmd = "convert /uploads/" + filename + " /processed/" + filename + ".pdf";
        Process proc = Runtime.getRuntime().exec(cmd);
        int exitCode;
        try { exitCode = proc.waitFor(); } catch (InterruptedException e) { exitCode = -1; }
        PrintWriter out = resp.getWriter();
        out.println("Exit: " + exitCode);
    }
}