Repository: streamlit/streamlit

Issue:
When "upload_file_request_handler.py" returns 400 error, we can see session ID.
# Summary

We make application on Microsoft Azure App Service with streamlit.
When we conducted a test of uploading file with `st.file_uploader`,  it returned 400 error and **session ID** as string.
We checked your codes and noticed that we have 400 error, `streamlit/lib/streamlit/server/upload_file_request_handler.py`  returns error code 400, reason and session ID on line 126-128.
This problem may lead to security incidents like XSS.
Please check it.

# Steps to reproduce

Code snippet:

```
import streamlit as st

uploaded_file = st.file_uploader("uploading Excel files", type="xlsx", key="xlsx_up")
if uploaded_file is not None:
     st.write("Success")

```
How the error occurred cannot be provided due to confidentiality,

## Expected behavior:

When we have 400 error, streamlit will return only error code and error reason without session ID.

## Actual behavior:

When we have 400 error, streamlit returns error code and error reason with session ID
Screenshots cannot be uploaded due to confidentiality.

## Is this a regression?

That is, did this use to work the way you expected in the past?
yes / no
⇒no

# Debug info

- Streamlit version: (get it with `$ streamlit version`)
⇒0.74.1
- Python version: (get it with `$ python --version`)
⇒3.7
- Using Conda? PipEnv? PyEnv? Pex?
⇒Pip
- OS version:
⇒Linux
- Browser version:
⇒Chrome 88.0.4324.150


Discussion:
Thanks for raising this!

In the ideal world we should only be returning that error if a session ID is invalid in which case it should not matter what the `session_id` is since it should not be usable for any connection with the server. We should definitely pull out the `widget_id` out of the check and separate that so that we are not potentially exposing a valid `session_id`. Once that is done, I think it should be fine showing an invalid `session_id` but would love to get your thoughts!
Thank you for your comment.
We can understand what you think about this issue.

We got a capture that shows the problem. 
We send POST message to our uploading functions using streamlit on Azure App service with invalid session ID and an script to get Cookie.
Application returned original invalid session ID and script without escaped method.
This script will be used to attack application or get information in the system.
I think streamlit should escape invalid scripts for avoid attack from someone.

Thank you for your consideration.

<img width="960" alt="POST_image" src="https://user-images.githubusercontent.com/79143792/108495411-1bd93480-72ec-11eb-817f-827a94dd85ba.png">

Deployed a docker container to a Kubernetes cluster and I'm hitting this error as well. It seems to work every other time. Any workarounds?

Resolving patch:
diff --git a/lib/streamlit/web/server/upload_file_request_handler.py b/lib/streamlit/web/server/upload_file_request_handler.py
--- a/lib/streamlit/web/server/upload_file_request_handler.py
+++ b/lib/streamlit/web/server/upload_file_request_handler.py
@@ -99,7 +99,7 @@ def put(self, **kwargs):
 
         try:
             if not self._is_active_session(session_id):
-                raise Exception(f"Invalid session_id: '{session_id}'")
+                raise Exception(f"Invalid session_id")
         except Exception as e:
             self.send_error(400, reason=str(e))
             return


Test patch:
diff --git a/lib/tests/streamlit/web/server/upload_file_request_handler_test.py b/lib/tests/streamlit/web/server/upload_file_request_handler_test.py
--- a/lib/tests/streamlit/web/server/upload_file_request_handler_test.py
+++ b/lib/tests/streamlit/web/server/upload_file_request_handler_test.py
@@ -184,5 +184,5 @@ def test_upload_one_file(self):
         params = {file.name: file.data}
         response = self._upload_files(params, session_id="sessionId", file_id="fileId")
         self.assertEqual(400, response.code)
-        self.assertIn("Invalid session_id: 'sessionId'", response.reason)
+        self.assertIn("Invalid session_id", response.reason)
         self.assertEqual(self.file_mgr.get_files("sessionId", ["fileId"]), [])