# [CRUCIBLE-SEED]
# category: xss
# severity: medium
# language: python
# expected: XSS via FastAPI response with HTML and user-controlled query parameter

from fastapi import FastAPI, Query
from fastapi.responses import HTMLResponse

app = FastAPI()


@app.get("/welcome", response_class=HTMLResponse)
async def welcome(name: str = Query(default="Guest")):
    # name injected directly into HTML — no escaping applied
    html = f"""
    <!DOCTYPE html>
    <html>
      <head><title>Welcome</title></head>
      <body>
        <h1>Hello, {name}!</h1>
        <p>Thanks for visiting.</p>
      </body>
    </html>
    """
    return HTMLResponse(content=html)


@app.get("/redirect-info", response_class=HTMLResponse)
async def redirect_info(from_url: str = Query(default="/")):
    # from_url reflected in response — open redirect + XSS
    return HTMLResponse(
        f'<p>You were redirected from: <a href="{from_url}">{from_url}</a></p>'
    )