# [CRUCIBLE-SEED]
# category: ssrf
# severity: high
# language: ruby
# expected: open-uri used to fetch user-supplied URL — SSRF including file:// scheme

require 'open-uri'

def fetch_remote_resource(url)
  URI.open(url).read
end

def download_image(image_url)
  URI.open(image_url) do |f|
    File.write('/tmp/downloaded_image', f.read)
  end
end

class ResourceController < ApplicationController
  def import
    resource_url = params[:url]
    content      = URI.open(resource_url).read
    render plain: content
  end
end