// [CRUCIBLE-SEED]
// category: log_injection
// severity: medium
// language: java
// expected: Log injection via logger.error with exception message containing user input

import org.apache.log4j.Logger;
import javax.servlet.http.*;
import java.io.IOException;

public class ApiGatewayServlet extends HttpServlet {
    private static final Logger log = Logger.getLogger(ApiGatewayServlet.class);

    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws IOException {
        String apiKey  = req.getParameter("api_key");
        String method  = req.getParameter("method");
        // Vulnerable: method and apiKey injected into log entries without stripping CR/LF
        log.warn("API call - method: " + method + ", key: " + apiKey);
        try {
            dispatch(method, apiKey);
        } catch (Exception e) {
            // Vulnerable: exception message may contain user input
            log.error("Dispatch failed for method: " + method + " - " + e.getMessage());
            resp.sendError(500);
        }
    }

    private void dispatch(String method, String key) throws Exception {
        if (method == null) throw new Exception("Unknown method: " + method);
    }
}