// [CRUCIBLE-SEED]
// category: command_injection
// severity: critical
// language: java
// expected: Command injection via Runtime.exec with user-controlled zip archive name

import java.io.*;
import javax.servlet.http.*;

public class ArchiveServlet extends HttpServlet {
    private static final String ARCHIVE_DIR = "/var/archives/";

    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String archiveName = req.getParameter("name");
        String targetDir   = req.getParameter("dir");
        // Vulnerable: both parameters injected into unzip command
        String cmd = "unzip " + ARCHIVE_DIR + archiveName + " -d " + targetDir;
        Runtime.getRuntime().exec(new String[]{"/bin/bash", "-c", cmd});
        resp.getWriter().println("Extracting archive...");
    }
}