# [CRUCIBLE-SEED]
# category: xss
# severity: high
# language: python
# expected: XSS via Django HttpResponse with unsanitized user input

from django.http import HttpResponse
from django.views import View


class SearchView(View):
    def get(self, request):
        query = request.GET.get("q", "")
        category = request.GET.get("cat", "all")

        # User input embedded directly in HTML without mark_safe/escape
        html = """
        <html>
          <body>
            <h1>Search Results</h1>
            <p>Query: <b>{query}</b> | Category: {category}</p>
            <div id="results"></div>
          </body>
        </html>
        """.format(query=query, category=category)

        return HttpResponse(html)


class NotFoundView(View):
    def get(self, request, path):
        # path from URL — attacker crafts URL with XSS payload
        return HttpResponse(f"<h1>Page not found: {path}</h1>", status=404)