Language: Python
Label: vulnerable
CWE: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Code:
    def download(self, debug_file_id, project):
        rate_limited = ratelimits.is_limited(
            project=project,
            key=f"rl:DSymFilesEndpoint:download:{debug_file_id}:{project.id}",
            limit=10,
        )
        if rate_limited:
            logger.info(
                "notification.rate_limited",
                extra={"project_id": project.id, "project_debug_file_id": debug_file_id},
            )
            return HttpResponse({"Too many download requests"}, status=403)

        debug_file = ProjectDebugFile.objects.filter(id=debug_file_id).first()

        if debug_file is None:
            raise Http404

        try:
            fp = debug_file.file.getfile()
            response = StreamingHttpResponse(
                iter(lambda: fp.read(4096), b""), content_type="application/octet-stream"
            )
            response["Content-Length"] = debug_file.file.size
            response["Content-Disposition"] = 'attachment; filename="{}{}"'.format(
                posixpath.basename(debug_file.debug_id),
                debug_file.file_extension,
            )
            return response
        except OSError:
            raise Http404