What the developer wrote
Authored by f321x
qml: disallow wallet names starting with '.'
Prevent users from creating or renaming wallet files starting with
a `.` as those files are not listed in the wallet list, making it
impossible to access the wallet.
Later we could allow this again and implement opening such a "hidden"
wallet file e.g. through the wizard.
Related https://github.com/spesmilo/electrum/issues/10688
What changed, and why it matters
This commit stops users of Electrum's mobile-style QML interface from giving a wallet a name that begins with a dot (like '.secret'). Such 'hidden' files are normally invisible in the wallet list, so a user could create a wallet and then be unable to see or open it again. The change is a simple guard that rejects these names when creating or renaming wallets.
No urgent action needed; this is a low-severity hardening change. Users on QML builds should update normally. Future releases may reintroduce hidden-wallet support through the wizard, per the TODO.
Security signals we found
UI-level input validation hardening
Prevents creation of hidden wallet files that would be omitted from wallet list
Avoids potential user lock-out / inaccessible funds due to hidden filename
Evidence from the diff
In electrum/gui/qml/qedaemon.py, the wallet name validation in QEDaemon now returns False if wallet_name.startswith(‘.’). The commit message explains that dot-prefixed wallet files are not listed in the QML wallet list, so allowing them would strand the wallet. The patch is defensive UI hardening rather than a fix for an active vulnerability.
Changed components
electrum/gui/qml/qedaemon.pyQML wallet creation/rename flowInspect captured patch +3 / −0
diff --git a/electrum/gui/qml/qedaemon.py b/electrum/gui/qml/qedaemon.py
index 28a6640..3b3ea75 100644
--- a/electrum/gui/qml/qedaemon.py
+++ b/electrum/gui/qml/qedaemon.py
@@ -325,6 +325,9 @@ class QEDaemon(AuthMixin, QObject):
for forbidden_char in ("/", "\\", ):
if forbidden_char in wallet_name:
return False
+ if wallet_name.startswith('.'): # not shown in wallet list
+ # TODO: allow wallets starting with '.' as hidden wallets, opened e.g. through wallet creation wizard
+ return False
if os.path.basename(wallet_name) != wallet_name: # '/foo/bar/' returns 'bar'
return False
wallet_path = self.wallet_path_from_wallet_name(wallet_name)
Why this scored 28/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.