// [CRUCIBLE-SEED]
// category: xxe
// severity: critical
// language: java
// expected: XXE via JAXB Unmarshaller processing user-supplied XML without secure settings

import javax.xml.bind.*;
import java.io.*;
import javax.servlet.http.*;

public class OrderUnmarshalServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws Exception {
        // Vulnerable: JAXB uses DocumentBuilderFactory internally; XXE possible by default
        JAXBContext ctx = JAXBContext.newInstance(Order.class);
        Unmarshaller um = ctx.createUnmarshaller();
        Object result = um.unmarshal(req.getInputStream());
        resp.getWriter().println("Received order: " + result);
    }

    static class Order {
        public String id;
        public String product;
        public int quantity;
    }
}