# [CRUCIBLE-SEED]
# category: yaml_injection
# severity: critical
# language: python
# expected: yaml.load() without safe_load — RCE via !!python/object tags in YAML

import yaml
import os
from pathlib import Path


def load_pipeline_config(config_path: str) -> dict:
    """Load a pipeline configuration from a YAML file."""
    with open(config_path, "r") as f:
        # yaml.load() without Loader allows arbitrary Python object instantiation
        # Attacker-controlled config file: !!python/object/apply:subprocess.check_output [['id']]
        return yaml.load(f)


def load_user_preferences(user_id: str) -> dict:
    prefs_path = Path(f"/var/app/preferences/{user_id}.yaml")
    if not prefs_path.exists():
        return {}
    with prefs_path.open() as f:
        # User controls their own preference file — YAML injection if file content is user-controlled
        return yaml.load(f.read())


def merge_configs(*config_paths: str) -> dict:
    merged = {}
    for path in config_paths:
        with open(path) as f:
            data = yaml.load(f)  # unsafe
            if isinstance(data, dict):
                merged.update(data)
    return merged


def parse_webhook_payload(yaml_str: str) -> dict:
    # Webhook body parsed as YAML without safe_load
    return yaml.load(yaml_str)