# [CRUCIBLE-SEED]
# category: ssrf
# severity: critical
# language: ruby
# expected: Faraday connection built from user-controlled base URL

require 'faraday'

class ImportController < ApplicationController
  def import_feed
    source_url = params[:feed_url]
    conn       = Faraday.new(url: source_url)
    response   = conn.get('/')
    data       = JSON.parse(response.body)
    render json: { imported: data.size }
  end

  def fetch_avatar
    avatar_url = params[:avatar_url]
    response   = Faraday.get(avatar_url)
    send_data response.body, type: 'image/jpeg'
  end
end