# [CRUCIBLE-SEED]
# category: yaml_deserialization
# severity: critical
# language: ruby
# expected: YAML.load used in API endpoint — remote code execution via crafted payload

require 'sinatra'
require 'yaml'

post '/api/import' do
  content_type :json
  raw_body = request.body.read
  data     = YAML.load(raw_body)
  process_import(data)
  { imported: data.keys.count }.to_json
end

post '/api/config/update' do
  yaml_config = params[:yaml]
  config      = YAML.load(yaml_config)
  config.each { |k, v| CONFIG[k] = v }
  { updated: true }.to_json
end

def process_import(data)
  data.each { |k, v| puts "#{k}: #{v}" }
end