// [CRUCIBLE-SEED]
// category: log_injection
// severity: medium
// language: java
// expected: Log injection via logger.info with unvalidated user input enabling log forging

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.servlet.http.*;
import java.io.IOException;

public class LoginAuditServlet extends HttpServlet {
    private static final Logger logger = LoggerFactory.getLogger(LoginAuditServlet.class);

    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String username = req.getParameter("username");
        String ip       = req.getHeader("X-Forwarded-For");
        // Vulnerable: attacker-controlled input logged without sanitization
        // e.g. username = "admin\nINFO: Successful login for admin"
        logger.info("Login attempt for user: " + username + " from IP: " + ip);
        // ... authentication logic
        resp.getWriter().println("Login processed");
    }
}