# [CRUCIBLE-SEED]
# category: ssrf
# severity: critical
# language: ruby
# expected: HTTParty.get with user-supplied URL — SSRF to internal services

require 'httparty'

class WebhookController < ApplicationController
  def trigger
    callback_url = params[:callback]
    payload      = { event: 'triggered', timestamp: Time.now.to_i }
    HTTParty.post(callback_url, body: payload.to_json, headers: { 'Content-Type' => 'application/json' })
    render json: { triggered: true }
  end

  def preview_url
    url  = params[:url]
    resp = HTTParty.get(url, timeout: 5)
    render plain: resp.body
  end
end