// [CRUCIBLE-SEED]
// category: command_injection
// severity: critical
// language: java
// expected: Command injection via ProcessBuilder with user-controlled arguments

import java.io.*;
import java.util.Arrays;
import javax.servlet.http.*;

public class ImageResizerServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String inputFile  = req.getParameter("input");
        String width      = req.getParameter("width");
        String height     = req.getParameter("height");
        // Vulnerable: width/height not validated, passed to shell via ProcessBuilder
        ProcessBuilder pb = new ProcessBuilder(
            "/bin/sh", "-c",
            "ffmpeg -i " + inputFile + " -vf scale=" + width + ":" + height + " out.mp4");
        pb.redirectErrorStream(true);
        Process p = pb.start();
        PrintWriter out = resp.getWriter();
        new BufferedReader(new InputStreamReader(p.getInputStream()))
            .lines().forEach(l -> out.println(l));
    }
}