// [CRUCIBLE-SEED]
// category: path_traversal
// severity: high
// language: java
// expected: Path traversal via file write using user-supplied output path

import java.io.*;
import javax.servlet.http.*;

public class ReportWriterServlet extends HttpServlet {
    private static final String REPORT_BASE = "/var/reports/";

    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String reportName = req.getParameter("reportName");
        String content    = req.getParameter("content");
        // Vulnerable: reportName can traverse directories (../../etc/cron.d/backdoor)
        File out = new File(REPORT_BASE + reportName + ".txt");
        try (FileWriter fw = new FileWriter(out)) {
            fw.write(content);
        }
        resp.getWriter().println("Report saved.");
    }
}