# [CRUCIBLE-SEED]
# category: eval_abuse
# severity: high
# language: python
# expected: eval() used in Jinja2-like custom template rendering with user template string

import re
from flask import Flask, request

app = Flask(__name__)


def render_template(template: str, context: dict) -> str:
    """Simple template renderer that evaluates {{ expr }} blocks."""
    def evaluate(match):
        expr = match.group(1).strip()
        # eval with user-controlled expression — attacker injects arbitrary Python
        return str(eval(expr, {"__builtins__": {}}, context))

    return re.sub(r"\{\{(.*?)\}\}", evaluate, template)


@app.route("/preview", methods=["POST"])
def preview():
    data = request.get_json()
    template = data.get("template", "Hello {{ name }}!")
    ctx = data.get("context", {"name": "World"})
    # Attacker template: "{{ __import__('os').system('id') }}"
    output = render_template(template, ctx)
    return output


@app.route("/report", methods=["POST"])
def report():
    tpl = request.form.get("template", "")
    rendered = render_template(tpl, {"user": request.form.get("user", "guest")})
    return rendered