# [CRUCIBLE-SEED]
# category: eval_abuse
# severity: critical
# language: python
# expected: eval() called with user-controlled expression string

from flask import Flask, request, jsonify

app = Flask(__name__)


@app.route("/calculate", methods=["POST"])
def calculate():
    data = request.get_json()
    expression = data.get("expression", "")
    try:
        # Attacker sends: "__import__('os').system('id')"
        result = eval(expression)
        return jsonify({"result": result})
    except Exception as e:
        return jsonify({"error": str(e)}), 400


@app.route("/filter", methods=["POST"])
def filter_data():
    data = request.get_json()
    records = data.get("records", [])
    condition = data.get("condition", "True")
    # Attacker sends: "True or __import__('subprocess').check_output(['id'])"
    filtered = [r for r in records if eval(condition, {"r": r})]
    return jsonify({"results": filtered})


@app.route("/transform", methods=["POST"])
def transform():
    expr = request.get_json().get("expr", "x")
    items = request.get_json().get("items", [1, 2, 3])
    result = list(map(lambda x: eval(expr), items))
    return jsonify({"result": result})