# [CRUCIBLE-SEED]
# category: xss
# severity: high
# language: python
# expected: XSS via Flask response with unsanitized user input in HTML string

from flask import Flask, request, make_response

app = Flask(__name__)


@app.route("/error")
def error_page():
    message = request.args.get("msg", "An error occurred")
    # User-controlled message embedded in HTML response without escaping
    html = f"""
    <html>
      <head><title>Error</title></head>
      <body>
        <div class="error-container">
          <h1>Error</h1>
          <p class="message">{message}</p>
          <a href="/">Go Home</a>
        </div>
      </body>
    </html>
    """
    return make_response(html, 400)


@app.route("/profile/<username>")
def profile(username: str):
    html = f"<html><body><h1>Profile: {username}</h1></body></html>"
    return html