# [CRUCIBLE-SEED]
# category: path_traversal
# severity: critical
# language: ruby
# expected: send_file with user-controlled path — arbitrary file download

class DownloadsController < ApplicationController
  def get_file
    filename = params[:file]
    base_dir = Rails.root.join('public', 'downloads')
    file_path = File.join(base_dir, filename)
    send_file file_path
  end

  def export
    name = params[:name]
    path = "/var/reports/#{name}"
    send_file path, type: 'application/octet-stream'
  end
end