# [CRUCIBLE-SEED]
# category: xss
# severity: high
# language: python
# expected: XSS via Jinja2 |safe filter applied to user-controlled content

from flask import Flask, request, render_template_string

app = Flask(__name__)

ARTICLE_TEMPLATE = """
<!DOCTYPE html>
<html>
<head><title>{{ title }}</title></head>
<body>
  <article>
    <h1>{{ title }}</h1>
    <!-- |safe disables Jinja2 autoescaping — XSS if content is user-controlled -->
    <div class="content">{{ content | safe }}</div>
    <footer>By: {{ author | safe }}</footer>
  </article>
</body>
</html>
"""


@app.route("/articles/<int:article_id>")
def view_article(article_id: int):
    # In practice, content and author come from DB — but users control their own author field
    from myapp.models import Article
    article = Article.objects.get(pk=article_id)
    return render_template_string(
        ARTICLE_TEMPLATE,
        title=article.title,
        content=article.body,    # user-submitted rich text
        author=article.author_bio,  # user-controlled bio
    )