# [CRUCIBLE-SEED]
# category: eval_abuse
# severity: high
# language: python
# expected: eval() in pandas query/eval with user-controlled expression

import pandas as pd
from flask import Flask, request, jsonify

app = Flask(__name__)

# Simulated data store
DATA = pd.DataFrame({
    "id": range(1, 101),
    "amount": [i * 10.5 for i in range(1, 101)],
    "category": ["A" if i % 2 == 0 else "B" for i in range(1, 101)],
    "active": [True] * 100,
})


@app.route("/data/query", methods=["POST"])
def query_data():
    body = request.get_json()
    filter_expr = body.get("filter", "active == True")
    # pd.DataFrame.query() can execute arbitrary Python when filter_expr is user-controlled
    # Attacker: "@__import__('os').system('id')"
    try:
        result = DATA.query(filter_expr)
        return jsonify({"count": len(result), "data": result.to_dict("records")})
    except Exception as e:
        return jsonify({"error": str(e)}), 400


@app.route("/data/eval", methods=["POST"])
def eval_expression():
    expr = request.get_json().get("expr", "amount * 2")
    result = DATA.eval(expr)
    return jsonify({"result": result.tolist()})