# [CRUCIBLE-SEED]
# category: xss
# severity: critical
# language: python
# expected: SSTI (Server-Side Template Injection) via Jinja2 render_template_string with user-controlled template

from flask import Flask, request, render_template_string

app = Flask(__name__)


@app.route("/render")
def render_custom():
    # Attacker sends: ?template={{config.SECRET_KEY}} or {{''.__class__.__mro__[1].__subclasses__()}}
    user_template = request.args.get("template", "<p>Hello World</p>")
    context = {
        "user": request.args.get("user", "guest"),
        "app_name": "MyApp",
    }
    # render_template_string with user-controlled template = SSTI
    return render_template_string(user_template, **context)


@app.route("/email-preview", methods=["POST"])
def email_preview():
    template_body = request.form.get("template", "")
    recipient_name = request.form.get("name", "User")
    # Attacker injects Jinja2 expressions into the template body
    rendered = render_template_string(template_body, name=recipient_name)
    return rendered