Language: Python
Label: vulnerable
CWE: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Code:
def get_legacy_release_bundles(release: Release, dist: Optional[Distribution]):
    return set(
        ReleaseFile.objects.select_related("file")
        .filter(
            release_id=release.id,
            dist_id=dist.id if dist else None,
            # a `ReleaseFile` with `0` artifacts represents a release archive,
            # see the comment above the definition of `artifact_count`.
            artifact_count=0,
            # similarly the special `type` is also used for release archives.
            file__type=RELEASE_BUNDLE_TYPE,
        )
        .values_list("file_id", flat=True)
        # TODO: this `order_by` might be incredibly slow
        # we want to have a hard limit on the returned bundles here. and we would
        # want to pick the most recently uploaded ones. that should mostly be
        # relevant for customers that upload multiple bundles, or are uploading
        # newer files for existing releases. In that case the symbolication is
        # already degraded, so meh...
        # .order_by("-file__timestamp")
        [:MAX_BUNDLES_QUERY]
    )