# [CRUCIBLE-SEED]
# category: command_injection
# severity: critical
# language: python
# expected: command injection via subprocess.call with shell=True and user input

import subprocess
from flask import Flask, request, jsonify

app = Flask(__name__)


@app.route("/git/clone", methods=["POST"])
def git_clone():
    data = request.get_json()
    repo_url = data.get("url", "")
    target_dir = data.get("dir", "/tmp/repo")
    # shell=True means the full string is passed to /bin/sh
    ret = subprocess.call(f"git clone {repo_url} {target_dir}", shell=True)
    return jsonify({"return_code": ret})


@app.route("/nmap", methods=["POST"])
def nmap_scan():
    target = request.get_json().get("target", "")
    ports = request.get_json().get("ports", "1-1000")
    # target and ports from user — shell injection via semicolons
    result = subprocess.check_output(
        f"nmap -p {ports} {target}", shell=True, text=True
    )
    return jsonify({"output": result})


@app.route("/whois")
def whois():
    domain = request.args.get("domain", "")
    output = subprocess.check_output(f"whois {domain}", shell=True, text=True)
    return jsonify({"result": output})