# [CRUCIBLE-SEED]
# category: command_injection
# severity: high
# language: python
# expected: command injection via os.popen with user-controlled filename

import os
from flask import Flask, request, send_file
import io

app = Flask(__name__)


@app.route("/export/csv")
def export_csv():
    table = request.args.get("table", "users")
    date = request.args.get("date", "2024-01-01")
    # table and date injected via shell — attacker: table = "users; id > /tmp/pwned"
    output = os.popen(f"psql -c 'SELECT * FROM {table} WHERE date > \"{date}\"' -A -F, mydb").read()
    return output, 200, {"Content-Type": "text/csv"}


@app.route("/preview/pdf")
def preview_pdf():
    filename = request.args.get("file", "")
    # filename from user — injection via backticks or semicolons
    output = os.popen(f"pdftotext uploads/{filename} -").read()
    return {"text": output}


@app.route("/image/metadata")
def image_metadata():
    path = request.args.get("path", "")
    result = os.popen(f"exiftool {path}").read()
    return {"metadata": result}