# [CRUCIBLE-SEED]
# category: command_injection
# severity: critical
# language: python
# expected: command injection via os.system with user-controlled input

import os
from flask import Flask, request, jsonify

app = Flask(__name__)


@app.route("/tools/ping")
def ping():
    host = request.args.get("host", "")
    # Attacker: host = "8.8.8.8; cat /etc/passwd"
    exit_code = os.system(f"ping -c 4 {host}")
    return jsonify({"exit_code": exit_code})


@app.route("/tools/convert", methods=["POST"])
def convert_file():
    data = request.get_json()
    input_file = data.get("input", "")
    output_format = data.get("format", "pdf")
    # os.system executes in shell — injection via semicolons, backticks, etc.
    os.system(f"convert {input_file} output.{output_format}")
    return jsonify({"status": "done"})


@app.route("/tools/compress", methods=["POST"])
def compress():
    data = request.get_json()
    folder = data.get("folder", "")
    name = data.get("archive_name", "archive")
    os.system(f"tar -czf /tmp/{name}.tar.gz {folder}")
    return jsonify({"archive": f"/tmp/{name}.tar.gz"})