# [CRUCIBLE-SEED]
# category: xss
# severity: medium
# language: ruby
# expected: User content embedded in JSON output that is then eval()d client-side

class ApiController < ApplicationController
  def user_data
    user  = User.find(params[:id])
    bio   = params[:bio] || user.bio
    @json = { name: user.name, bio: bio, role: params[:role] }
    render json: @json
  end

  def config
    callback = params[:callback]
    data     = { status: 'ok', user: current_user&.name }
    render plain: "#{callback}(#{data.to_json})"
  end
end