# [CRUCIBLE-SEED]
# category: yaml_injection
# severity: critical
# language: python
# expected: yaml.load() with untrusted input — arbitrary code execution via YAML deserialization

import yaml
from flask import Flask, request, jsonify

app = Flask(__name__)


@app.route("/config/upload", methods=["POST"])
def upload_config():
    raw_yaml = request.data.decode("utf-8")
    # yaml.load without Loader= defaults to full deserialization — RCE possible
    # Attacker payload: "!!python/object/apply:os.system ['id']"
    config = yaml.load(raw_yaml)
    return jsonify({"loaded_keys": list(config.keys()) if isinstance(config, dict) else []})


@app.route("/workflow/import", methods=["POST"])
def import_workflow():
    yaml_content = request.get_json().get("yaml", "")
    # yaml.load with untrusted string
    workflow = yaml.load(yaml_content)
    steps = workflow.get("steps", []) if isinstance(workflow, dict) else []
    return jsonify({"steps": steps})


@app.route("/settings/restore", methods=["POST"])
def restore_settings():
    uploaded = request.files.get("settings")
    if not uploaded:
        return jsonify({"error": "No file"}), 400
    content = uploaded.read().decode("utf-8")
    settings = yaml.load(content)  # unsafe loader
    return jsonify({"restored": True, "settings": settings})