CVE-2023-47117: Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task

@staticmethod
def _create_filters(filter_group, filters_data):
filter_index = 0
for filter_data in filters_data:
filter_data["index"] = filter_index
filter_group.filters.add(Filter.objects.create(**filter_data))
filter_index += 1

class TaskQuerySet(models.QuerySet):
def prepared(self, prepare_params=None):
""" Apply filters, ordering and selected items to queryset

:param prepare_params: prepare params with project, filters, orderings, etc
:return: ordered and filtered queryset
"""
from projects.models import Project

queryset = self

if prepare_params is None:
return queryset

project = Project.objects.get(pk=prepare_params.project)
request = prepare_params.request
queryset = apply_filters(queryset, prepare_params.filters, project, request) <1>
queryset = apply_ordering(queryset, prepare_params.ordering, project, request, view_data=prepare_params.data)

if not prepare_params.selectedItems:
return queryset