// [CRUCIBLE-SEED]
// category: ssrf
// severity: high
// language: java
// expected: SSRF via URL.openConnection with user-supplied URL parameter

import java.io.*;
import java.net.*;
import javax.servlet.http.*;

public class ProxyServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String targetUrl = req.getParameter("url");
        // Vulnerable: opens connection to any URL including internal services
        URL url = new URL(targetUrl);
        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
        conn.setConnectTimeout(5000);
        conn.setReadTimeout(5000);
        InputStream is = conn.getInputStream();
        resp.setContentType(conn.getContentType());
        is.transferTo(resp.getOutputStream());
    }
}