# [CRUCIBLE-SEED]
# category: path_traversal
# severity: critical
# language: ruby
# expected: File.read with unvalidated user-supplied path

class FilesController < ApplicationController
  def show
    filename = params[:filename]
    content  = File.read("/var/app/uploads/#{filename}")
    render plain: content
  end

  def download
    path = params[:path]
    data = File.read(path)
    send_data data, filename: File.basename(path)
  end
end