Patched code sample

import streamlit as st

# This code demonstrates the fix for a vulnerability where sensitive data
# was stored in a process-wide environment variable (os.environ).
#
# The vulnerability (as described in the fictional CVE-2026-29872):
# Storing user-supplied tokens in os.environ in a multi-user Streamlit app
# leads to cross-session information disclosure, as os.environ is shared
# across all user sessions handled by the same Python process.
#
# The Fix:
# Use Streamlit's built-in session state (`st.session_state`) to store
# sensitive, user-specific data. `st.session_state` is a dictionary-like
# object that is isolated to a single user's browser session, preventing
# data from leaking between concurrent users.

st.set_page_config(layout="wide")
st.title("Secure Credential Handling (Fixed Example)")
st.markdown(
    """
    This application demonstrates the correct, secure way to handle user-specific
    secrets like API keys in a Streamlit application. It uses `st.session_state`
    to ensure that each user's data is isolated to their own session.
    """
)

# --- User Input Section ---
st.header("1. Enter Your Credentials")
st.warning(
    "This is a demonstration. Do not use real production credentials.", icon="⚠️"
)

# Use a form to group inputs and the submission button.
with st.form("api_key_form"):
    api_key_input = st.text_input(
        "Enter your API Key (e.g., GitHub PAT):",
        type="password",
        help="The key will be stored securely in your session state.",
    )
    submitted = st.form_submit_button("Store Key for this Session")

    if submitted and api_key_input:
        # FIXED: Store the API key in the isolated session_state.
        # This is the core of the vulnerability fix. Data in st.session_state
        # is only accessible to the current user's session.
        st.session_state["user_api_key"] = api_key_input
        st.success("API Key has been securely stored for this session only.")
    elif submitted and not api_key_input:
        st.error("Please provide an API key.")


# --- Action Section ---
st.header("2. Use the Stored Credential")
st.markdown(
    """
    Click the button below to simulate an action that requires the API key.
    The application will attempt to retrieve the key from the secure
    `st.session_state`. If you open this app in another browser tab, you will
    see that the key is not shared.
    """
)

if st.button("Simulate API Call"):
    # Securely retrieve the key from the current user's session state.
    # The .get() method is used to safely access the key, returning None if not found.
    retrieved_key = st.session_state.get("user_api_key")

    if retrieved_key:
        st.info("An API key was found in your session state.")
        # In a real application, you would now use this key to initialize an API client.
        # For example: `api_client = SomeAPIClient(api_key=retrieved_key)`
        #
        # For demonstration purposes, we show a masked version of the key
        # to prove it was retrieved without exposing it fully.
        masked_key = retrieved_key[:4] + "****" + retrieved_key[-4:]
        st.code(f"Simulating API call with key: {masked_key}", language="text")
        st.success("API call simulation complete.")
    else:
        # This is what a new, unauthenticated user would see. They cannot access
        # the key set by another user.
        st.error(
            "No API key found in your current session. "
            "Please enter a key in the form above."
        )

# --- Debug/Info Section ---
st.sidebar.header("Session State Inspector")
st.sidebar.markdown(
    "This shows the contents of `st.session_state` for *your* session."
)
# This will show that 'user_api_key' is present only after the user submits it.
st.sidebar.write(st.session_state)