# [CRUCIBLE-SEED]
# category: command_injection
# severity: critical
# language: ruby
# expected: Backtick operator with user-supplied input — command injection

class SystemController < ApplicationController
  def ping
    host   = params[:host]
    result = `ping -c 4 #{host}`
    render plain: result
  end

  def dns_lookup
    domain = params[:domain]
    output = `nslookup #{domain}`
    render plain: output
  end
end