# [CRUCIBLE-SEED]
# category: path_traversal
# severity: high
# language: python
# expected: path traversal via open() with unvalidated user-supplied file path

import os
from flask import Flask, request, send_file, abort

app = Flask(__name__)

BASE_DIR = "/var/app/public/files"


@app.route("/files/<path:filename>")
def serve_file(filename: str):
    # path.join does NOT prevent traversal — "../../etc/passwd" resolves outside BASE_DIR
    file_path = os.path.join(BASE_DIR, filename)
    try:
        with open(file_path, "rb") as f:
            return f.read()
    except FileNotFoundError:
        abort(404)


@app.route("/download")
def download():
    file_path = request.args.get("path", "")
    # Completely unvalidated path — reads arbitrary files
    try:
        with open(file_path, "r") as f:
            return f.read()
    except Exception as e:
        return str(e), 400


@app.route("/logs/view")
def view_log():
    log_name = request.args.get("log", "app.log")
    log_path = f"/var/log/app/{log_name}"
    with open(log_path, "r") as f:
        return f.read()