Language: Python
Label: vulnerable
CWE: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Code:
    def open(self, *args, **kwargs):
        """Websocket connection opened.

        Call our terminal manager to get a terminal, and connect to it as a
        client.
        """
        # Jupyter has a mixin to ping websockets and keep connections through
        # proxies alive. Call super() to allow that to set up:
        tornado.websocket.WebSocketHandler.open(self, *args, **kwargs)
        api_key = self.get_argument('api_key', None, True)
        token = self.get_argument('token', None, True)

        cwd = self.get_argument('cwd', None, True)
        term_name = self.get_argument('term_name', None, True)

        user = None
        if REQUIRE_USER_AUTHENTICATION and api_key and token:
            oauth_client = Oauth2Application.query.filter(
                Oauth2Application.client_id == api_key,
            ).first()
            if oauth_client:
                oauth_token, valid = authenticate_client_and_token(oauth_client.id, token)
                valid = valid and \
                    oauth_token and \
                    oauth_token.user
                if valid:
                    user = oauth_token.user
                else:
                    raise Exception('Invalid token')

        self.term_name = term_name if term_name else 'tty'
        if user:
            self.term_name = f'{self.term_name}_{user.id}'

        self._logger.info("TermSocket.open: %s", self.term_name)

        self.terminal = self.term_manager.get_terminal(self.term_name, cwd=cwd)
        self.terminal.clients.append(self)
        self.__initiate_terminal(self.terminal)