# [CRUCIBLE-SEED]
# category: path_traversal
# severity: medium
# language: python
# expected: path traversal via Flask send_from_directory with user-controlled subdirectory

import os
from flask import Flask, request, send_from_directory, abort

app = Flask(__name__)

UPLOADS_ROOT = "/var/uploads"


@app.route("/uploads/<user_id>/files")
def list_files(user_id: str):
    subdir = request.args.get("folder", "")
    # user_id and subdir can include "../" to escape UPLOADS_ROOT
    target_dir = os.path.join(UPLOADS_ROOT, user_id, subdir)
    try:
        files = os.listdir(target_dir)
        return {"files": files}
    except FileNotFoundError:
        abort(404)


@app.route("/uploads/<user_id>/get")
def get_file(user_id: str):
    filename = request.args.get("name", "")
    directory = request.args.get("dir", "")
    # send_from_directory with user-controlled directory + filename
    full_dir = os.path.join(UPLOADS_ROOT, user_id, directory)
    return send_from_directory(full_dir, filename)