# [CRUCIBLE-SEED]
# category: deserialization
# severity: critical
# language: python
# expected: pickle.loads used with untrusted data — arbitrary code execution

import pickle
import base64
from flask import Flask, request, jsonify

app = Flask(__name__)


@app.route("/session/restore", methods=["POST"])
def restore_session():
    session_data = request.cookies.get("session", "")
    if not session_data:
        return jsonify({"error": "No session"}), 401

    try:
        # pickle.loads executes arbitrary Python code embedded in the payload
        # Attacker payload: object with __reduce__ returning os.system('id')
        decoded = base64.b64decode(session_data)
        session = pickle.loads(decoded)
        return jsonify({"user": session.get("user"), "role": session.get("role")})
    except Exception as e:
        return jsonify({"error": "Invalid session"}), 400


@app.route("/cache/get", methods=["POST"])
def get_cached():
    raw = request.get_json().get("data", "")
    # Data from Redis — but Redis can be poisoned by attacker
    obj = pickle.loads(base64.b64decode(raw))
    return jsonify({"value": str(obj)})