// [CRUCIBLE-SEED]
// category: command_injection
// severity: critical
// language: java
// expected: Command injection via Runtime.exec with user-supplied email address

import java.io.*;

public class MailSender {
    public void sendReport(String email, String reportPath) throws IOException {
        // Vulnerable: email address concatenated directly into sendmail command
        String command = "sendmail -v " + email + " < " + reportPath;
        Process proc = Runtime.getRuntime().exec(
            new String[]{"/bin/sh", "-c", command});
        try {
            proc.waitFor();
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
        }
    }

    public static void main(String[] args) throws IOException {
        new MailSender().sendReport(args[0], "/reports/monthly.txt");
    }
}