// [CRUCIBLE-SEED]
// category: ssrf
// severity: high
// language: java
// expected: SSRF via URL.openStream with user-controlled webhook URL

import java.io.*;
import java.net.*;
import javax.servlet.http.*;

public class WebhookTesterServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String webhookUrl = req.getParameter("webhook_url");
        String payload    = req.getParameter("payload");
        // Vulnerable: attacker can direct the server to POST to internal endpoints
        URL url = new URL(webhookUrl);
        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
        conn.setRequestMethod("POST");
        conn.setDoOutput(true);
        conn.setRequestProperty("Content-Type", "application/json");
        try (OutputStream os = conn.getOutputStream()) {
            os.write(payload.getBytes());
        }
        int code = conn.getResponseCode();
        resp.getWriter().println("Webhook responded: " + code);
    }
}