# [CRUCIBLE-SEED]
# category: path_traversal
# severity: high
# language: python
# expected: path traversal via FastAPI file endpoint with unvalidated path parameter

import os
from fastapi import FastAPI, Query
from fastapi.responses import FileResponse, PlainTextResponse

app = FastAPI()

STATIC_ROOT = "/var/app/static"


@app.get("/static/{file_path:path}")
async def serve_static(file_path: str):
    # file_path can be "../../etc/passwd" — no normalization or boundary check
    full_path = os.path.join(STATIC_ROOT, file_path)
    if not os.path.isfile(full_path):
        return PlainTextResponse("Not found", status_code=404)
    return FileResponse(full_path)


@app.get("/config/view")
async def view_config(name: str = Query(...)):
    config_path = f"/etc/myapp/{name}.conf"
    try:
        with open(config_path) as f:
            return {"content": f.read()}
    except FileNotFoundError:
        return {"error": "Config not found"}, 404