Patched code sample

import json
import hmac
import hashlib
import secrets
from typing import Dict, Any, Optional

class SecureSessionManager:
    def __init__(self, secret_key: str):
        self.secret_key = secret_key.encode()
    
    def create_session_token(self, session_data: Dict[str, Any]) -> str:
        """Create secure session token with HMAC"""
        # Use JSON instead of pickle - only safe data types
        json_data = json.dumps(session_data, sort_keys=True)
        
        # Create HMAC signature for integrity
        signature = hmac.new(
            self.secret_key, 
            json_data.encode(), 
            hashlib.sha256
        ).hexdigest()
        
        # Combine data and signature
        token = f"{json_data}:{signature}"
        return base64.b64encode(token.encode()).decode()
    
    def load_user_session(self, session_token: str) -> Optional[Dict[str, Any]]:
        """Securely load user session with validation"""
        try:
            # Decode token
            decoded = base64.b64decode(session_token).decode()
            
            # Split data and signature
            if ':' not in decoded:
                return None
            
            json_data, signature = decoded.rsplit(':', 1)
            
            # Verify HMAC signature
            expected_sig = hmac.new(
                self.secret_key,
                json_data.encode(),
                hashlib.sha256
            ).hexdigest()
            
            if not hmac.compare_digest(signature, expected_sig):
                return None
            
            # Parse JSON data (safe deserialization)
            session_data = json.loads(json_data)
            
            # Additional validation
            if not isinstance(session_data, dict):
                return None
            
            return session_data
            
        except Exception:
            return None

# Secure usage
session_mgr = SecureSessionManager("your-secret-key")
token = session_mgr.create_session_token({"user_id": 123, "role": "user"})
session = session_mgr.load_user_session(token)