// [CRUCIBLE-SEED]
// category: deserialization
// severity: critical
// language: java
// expected: Unsafe deserialization via ObjectInputStream reading from Redis cache

import java.io.*;
import java.util.Base64;
import redis.clients.jedis.Jedis;

public class CacheService {
    private final Jedis jedis;

    public CacheService(Jedis jedis) { this.jedis = jedis; }

    public Object get(String key) throws Exception {
        String raw = jedis.get(key);
        if (raw == null) return null;
        byte[] bytes = Base64.getDecoder().decode(raw);
        // Vulnerable: deserializes data from Redis without class allowlist
        try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
            return ois.readObject();
        }
    }

    public void put(String key, Serializable value) throws Exception {
        ByteArrayOutputStream bos = new ByteArrayOutputStream();
        new ObjectOutputStream(bos).writeObject(value);
        jedis.set(key, Base64.getEncoder().encodeToString(bos.toByteArray()));
    }
}