Language: Python
Label: vulnerable
CWE: CWE-436 \u2014 Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Code:
def serve_file_unauthed_from_token(
    request: HttpRequest, token: str, filename: str
) -> HttpResponseBase:
    path_id = get_file_path_id_from_token(token)
    if path_id is None:
        raise JsonableError(_("Invalid token"))
    if path_id.split("/")[-1] != filename:
        raise JsonableError(_("Invalid filename"))

    mimetype, encoding = guess_type(path_id)
    download = mimetype not in INLINE_MIME_TYPES

    if settings.LOCAL_UPLOADS_DIR is not None:
        return serve_local(request, path_id, download=download)
    else:
        return serve_s3(request, path_id, download=download)