// [CRUCIBLE-SEED]
// category: path_traversal
// severity: high
// language: java
// expected: Path traversal via Paths.get with user input enabling directory escape

import java.io.*;
import java.nio.file.*;
import javax.servlet.http.*;

public class TemplateServlet extends HttpServlet {
    private static final Path TEMPLATE_DIR = Paths.get("/opt/app/templates");

    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String templateName = req.getParameter("template");
        // Vulnerable: resolve without startsWith check allows traversal
        Path templatePath = TEMPLATE_DIR.resolve(templateName);
        byte[] content = Files.readAllBytes(templatePath);
        resp.setContentType("text/html");
        resp.getOutputStream().write(content);
    }
}