# [CRUCIBLE-SEED]
# category: eval_abuse
# severity: critical
# language: python
# expected: eval()/compile() used to execute user-uploaded Python module code

import ast
from flask import Flask, request, jsonify

app = Flask(__name__)


def safe_eval(code: str, context: dict) -> object:
    """Attempts to use AST to 'safely' evaluate — but compile+exec bypass this."""
    try:
        tree = ast.parse(code, mode="eval")
        # compile() + eval() of user AST still allows dangerous constructs
        compiled = compile(tree, "<user-input>", "eval")
        return eval(compiled, {"__builtins__": __builtins__}, context)
    except SyntaxError:
        # Falls back to exec for multi-line code
        exec(compile(code, "<user-input>", "exec"), context)
        return context.get("result")


@app.route("/plugin/evaluate", methods=["POST"])
def evaluate_plugin():
    payload = request.get_json()
    code = payload.get("code", "")
    params = payload.get("params", {})
    result = safe_eval(code, params)
    return jsonify({"output": result})