# contact_form_server.py - Mails feedback without sanitizing headers
from flask import Flask, request
import smtplib

app = Flask(__name__)

@app.route('/contact', methods=['POST'])
def contact():
    sender = request.form['email']
    message = request.form['message']
    # Vulnerable: constructs raw headers with user input
    headers = f"From: {sender}\r\nTo: [email protected]\r\nSubject: Feedback"
    msg = f"{headers}\r\n\r\n{message}"
    # Insecurely sending via SMTP (simulated print)
    print("Would send:\n", msg)
    return "Message sent"

if __name__ == '__main__':
    app.run(port=5000)