Language: Python
Label: vulnerable
CWE: NVD-CWE-noinfo \u2014 

Code:
    async def get(self, request: web.Request) -> web.Response:
        """Return a list of persons if request comes from a local IP."""
        try:
            remote_address = ip_address(request.remote)  # type: ignore[arg-type]
        except ValueError:
            return self.json_message(
                message="Invalid remote IP",
                status_code=HTTPStatus.BAD_REQUEST,
                message_code="invalid_remote_ip",
            )

        hass: HomeAssistant = request.app["hass"]
        if is_cloud_connection(hass) or not is_local(remote_address):
            return self.json_message(
                message="Not local",
                status_code=HTTPStatus.BAD_REQUEST,
                message_code="not_local",
            )

        yaml, storage, _ = hass.data[DOMAIN]
        persons = [*yaml.async_items(), *storage.async_items()]

        return self.json(
            {
                person[ATTR_USER_ID]: {
                    ATTR_NAME: person[ATTR_NAME],
                    CONF_PICTURE: person.get(CONF_PICTURE),
                }
                for person in persons
                if person.get(ATTR_USER_ID)
            }
        )