// [CRUCIBLE-SEED]
// category: path_traversal
// severity: high
// language: java
// expected: Path traversal in file delete endpoint with user-controlled filename

import java.io.*;
import javax.servlet.http.*;

public class FileManagerServlet extends HttpServlet {
    private static final String UPLOAD_DIR = "/var/uploads/";

    protected void doDelete(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String filename = req.getParameter("name");
        // Vulnerable: attacker can delete arbitrary files via ../
        File target = new File(UPLOAD_DIR + filename);
        boolean deleted = target.delete();
        resp.setContentType("application/json");
        resp.getWriter().println("{\"deleted\":" + deleted + "}");
    }
}