# [CRUCIBLE-SEED]
# category: xss
# severity: high
# language: python
# expected: XSS via Mako/Chameleon template rendering with user-controlled variable without escaping

from mako.template import Template
from flask import Flask, request

app = Flask(__name__)


@app.route("/dashboard")
def dashboard():
    username = request.args.get("user", "Guest")
    notification = request.args.get("msg", "")

    # Mako ${} by default does NOT HTML-escape unless | h filter is used
    template = Template("""
    <html>
      <body>
        <h1>Welcome, ${username}!</h1>
        <div class="notification">${notification}</div>
        <div id="content">Your dashboard content goes here.</div>
      </body>
    </html>
    """)

    return template.render(username=username, notification=notification)


@app.route("/comment/<int:post_id>")
def view_comment(post_id: int):
    author = request.args.get("author", "Anonymous")
    body = request.args.get("body", "")
    tmpl = Template("<div><strong>${author}</strong>: ${body}</div>")
    return tmpl.render(author=author, body=body)