# [CRUCIBLE-SEED]
# category: yaml_deserialization
# severity: critical
# language: ruby
# expected: YAML.load with user-controlled input — allows arbitrary object instantiation

class ConfigController < ApplicationController
  def import
    config_data = params[:config]
    config      = YAML.load(config_data)
    apply_config(config)
    render json: { applied: true }
  end

  def load_template(template_string)
    YAML.load(template_string)
  end

  private

  def apply_config(cfg)
    cfg.each { |k, v| Rails.application.config.send("#{k}=", v) rescue nil }
  end
end