// [CRUCIBLE-SEED]
// category: path_traversal
// severity: high
// language: java
// expected: Path traversal via new File(basePath + userInput) without normalization

import java.io.*;
import javax.servlet.http.*;

public class FileDownloadServlet extends HttpServlet {
    private static final String BASE_DIR = "/var/app/uploads/";

    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String filename = req.getParameter("file");
        // Vulnerable: no normalization or containment check
        File file = new File(BASE_DIR + filename);
        resp.setContentType("application/octet-stream");
        resp.setHeader("Content-Disposition", "attachment; filename=\"" + filename + "\"");
        try (FileInputStream fis = new FileInputStream(file)) {
            byte[] buf = new byte[4096];
            int n;
            while ((n = fis.read(buf)) != -1) {
                resp.getOutputStream().write(buf, 0, n);
            }
        }
    }
}