Low 44 Bitcoin Committed Dec 11, 2025 · 16:48 UTC

transaction: tx_from_any: rm all whitespaces from str, none from bytes

37db6ea7 View source ↗

Public commit record

What the developer wrote

Authored by SomberNight

73/100 · Adequate

transaction: tx_from_any: rm all whitespaces from str, none from bytes

- whitespaces are safe to remove from strings, and is convenient if we do this for users
- bytes-like inputs should be left alone: individual bytes that look like whitespaces can appear in them anywhere
- even stripping the leading/trailing whitespaces is not safe to do: the first byte of the nVersion or the last byte of the nLocktime might look like whitespace too!
- instead, leading/trailing whitespaces can be stripped closer to where they are input, e.g. in the GUI
- e.g. ".txn" files that we ourselves create contain a complete tx as a hex string, with a trailing final newline in the file
- instead of reading that as bytes, we can read it as text
- ".psbt" files OTOH are binary

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

The short version

What changed, and why it matters

This commit fixes a bug in how Electrum reads transaction files. Previously, the program would strip whitespace from both text and raw binary transaction data. For binary data, this is dangerous because a byte that looks like a space or newline can legitimately appear in a transaction. The fix reads text files as text (and strips whitespace) and binary files as raw bytes (without altering them). This prevents certain unusual but valid transactions from being corrupted when loaded from a file.

Recommended action

Review and merge. The change is defensive and corrects a real data-handling bug. Users loading binary transaction files (especially PSBTs or raw transactions containing whitespace-like bytes) should upgrade to avoid potential load failures or silent corruption.

Security signals we found

Data integrity / malleability: stripping bytes from binary transaction inputs could silently alter a valid PSBT or raw tx

Input validation: clearer separation of text vs binary handling

Regression tests added/updated to enforce the new behavior

Technical analysis

Evidence from the diff

The patch changes tx_from_any / convert_raw_tx_to_hex in electrum/transaction.py so that whitespace is removed only from str inputs, never from bytes inputs. Previously, .strip() was applied to both, which could drop valid bytes such as 0x0a from raw transaction serializations. The Qt GUI’s file-open path now attempts to read as ASCII text first (stripping leading/trailing whitespace) and falls back to binary mode, ensuring .txn files with trailing newlines work while .psbt binary files remain untouched. Tests are updated to assert that bytes with whitespace anywhere raise SerializationError.

Changed components

electrum/transaction.pyelectrum/gui/qt/main_window.pytests/test_transaction.py

Inspect captured patch +46 / −32

diff --git a/electrum/gui/qt/main_window.py b/electrum/gui/qt/main_window.py
index 4144884..9b7552e 100644
--- a/electrum/gui/qt/main_window.py
+++ b/electrum/gui/qt/main_window.py
@@ -2368,13 +2368,26 @@ class ElectrumWindow(QMainWindow, MessageBoxMixin, Logger, QtEventListener):
         )
         if not fileName:
             return
+        file_content = None  # type: None | str | bytes
+        # 1. try to open file as "text"
         try:
-            with open(fileName, "rb") as f:
-                file_content = f.read()  # type: Union[str, bytes]
+            with open(fileName, "r", encoding="ascii") as f:
+                file_content = f.read()  # type: str
         except (ValueError, IOError, os.error) as reason:
-            self.show_critical(_("Electrum was unable to open your transaction file") + "\n" + str(reason),
-                               title=_("Unable to read file or no transaction found"))
-            return
+            pass
+        else:
+            assert isinstance(file_content, str), f"expected str, got {type(file_content)}"
+            file_content = file_content.strip()  # for text, we can safely strip leading/trailing whitespaces
+        # 2. try to open file as "binary"
+        if file_content is None:
+            try:
+                with open(fileName, "rb") as f:
+                    file_content = f.read()  # type: bytes
+            except (ValueError, IOError, os.error) as reason:
+                self.show_critical(_("Electrum was unable to open your transaction file") + "\n" + str(reason),
+                                   title=_("Unable to read file or no transaction found"))
+        if file_content is None:
+            return None
         return self.tx_from_text(file_content)
 
     def do_process_from_text(self):
diff --git a/electrum/transaction.py b/electrum/transaction.py
index 4d28995..dcfd5e6 100644
--- a/electrum/transaction.py
+++ b/electrum/transaction.py
@@ -1483,14 +1483,15 @@ def convert_raw_tx_to_hex(raw: Union[str, bytes]) -> str:
     if not raw:
         raise ValueError("empty string")
     raw_unstripped = raw
-    # try to remove whitespaces.
-    # FIXME we should NOT do *any* whitespace mangling for bytes-like inputs, only str
-    raw = raw.strip()  # remove leading/trailing whitespace, even if bytes-like
-    if isinstance(raw, str):  # remove all whitespace characters, if str
+    if isinstance(raw, str):
+        # remove all whitespace characters, anywhere, for convenience
+        # - leading/trailing whitespaces are quite common for user-input
+        # - newlines in the middle can also happen, e.g. when copying a raw tx from a pdf
         # note: we don't do this for bytes-like inputs, as whitespace-looking bytes can appear
         #       anywhere in a raw tx. Even leading/trailing pseudo-whitespace: consider that
-        #       the nVersion or the nLocktime might contain "0a" bytes
-        #       consider e.g.:  "\n".encode().hex() == "0a"
+        #       the nVersion or the nLocktime might contain e.g. "0a" bytes
+        #       consider:  "\n".encode().hex() == "0a"
+        #       For str, this is a non-issue and safe to do.
         raw = re.sub(r'\s', '', raw)
     # try hex
     try:
diff --git a/tests/test_transaction.py b/tests/test_transaction.py
index 6d10fb6..a7247c1 100644
--- a/tests/test_transaction.py
+++ b/tests/test_transaction.py
@@ -250,42 +250,42 @@ class TestTransaction(ElectrumTestCase):
     def test_tx_from_any(self):
         class RawTx(NamedTuple):
             data: Union[str, bytes]
-            is_whitespace_allowed: bool = True
         raw_tx_map = {
             "network_tx_hex_str": RawTx("0200000000010258e87a21b56daf0c23be8e7070456c336f7cbaa5c8757924f545887bb2abdd7500000000da00473044022074018ad4180097b873323c0015720b3684cc8123891048e7dbcd9b55ad679c99022073d369b740e3eb53dcefa33823c8070514ca55a7dd9544f157c167913261118c01483045022100f61038b308dc1da865a34852746f015772934208c6d24454393cd99bdf2217770220056e675a675a6d0a02b85b14e5e29074d8a25a9b5760bea2816f661910a006ea01475221029583bf39ae0a609747ad199addd634fa6108559d6c5cd39b4c2183f1ab96e07f2102dab61ff49a14db6a7d02b0cd1fbb78fc4b18312b5b4e54dae4dba2fbfef536d752aeffffffff838d0427d0ec650a68aa46bb0b098aea4422c071b2ca78352a077959d07cea1d01000000232200208c2353173743b595dfb4a07b72ba8e42e3797da74e87fe7d9d7497e3b2028903ffffffff0270aaf00800000000160014d85c2b71d0060b09c9886aeb815e50991dda124d00e1f5050000000016001400aea9a2e5f0f876a588df5546e8742d1d87008f000400473044022062eb7a556107a7c73f45ac4ab5a1dddf6f7075fb1275969a7f383efff784bcb202200c05dbb7470dbf2f08557dd356c7325c1ed30913e996cd3840945db12228da5f01473044022065f45ba5998b59a27ffe1a7bed016af1f1f90d54b3aa8f7450aa5f56a25103bd02207f724703ad1edb96680b284b56d4ffcb88f7fb759eabbe08aa30f29b851383d20147522103089dc10c7ac6db54f91329af617333db388cead0c231f723379d1b99030b02dc21023add904f3d6dcf59ddb906b0dee23529b7ffb9ed50e5e86151926860221f0e7352ae00000000"),
             "network_tx_hex_bytes": RawTx(b"0200000000010258e87a21b56daf0c23be8e7070456c336f7cbaa5c8757924f545887bb2abdd7500000000da00473044022074018ad4180097b873323c0015720b3684cc8123891048e7dbcd9b55ad679c99022073d369b740e3eb53dcefa33823c8070514ca55a7dd9544f157c167913261118c01483045022100f61038b308dc1da865a34852746f015772934208c6d24454393cd99bdf2217770220056e675a675a6d0a02b85b14e5e29074d8a25a9b5760bea2816f661910a006ea01475221029583bf39ae0a609747ad199addd634fa6108559d6c5cd39b4c2183f1ab96e07f2102dab61ff49a14db6a7d02b0cd1fbb78fc4b18312b5b4e54dae4dba2fbfef536d752aeffffffff838d0427d0ec650a68aa46bb0b098aea4422c071b2ca78352a077959d07cea1d01000000232200208c2353173743b595dfb4a07b72ba8e42e3797da74e87fe7d9d7497e3b2028903ffffffff0270aaf00800000000160014d85c2b71d0060b09c9886aeb815e50991dda124d00e1f5050000000016001400aea9a2e5f0f876a588df5546e8742d1d87008f000400473044022062eb7a556107a7c73f45ac4ab5a1dddf6f7075fb1275969a7f383efff784bcb202200c05dbb7470dbf2f08557dd356c7325c1ed30913e996cd3840945db12228da5f01473044022065f45ba5998b59a27ffe1a7bed016af1f1f90d54b3aa8f7450aa5f56a25103bd02207f724703ad1edb96680b284b56d4ffcb88f7fb759eabbe08aa30f29b851383d20147522103089dc10c7ac6db54f91329af617333db388cead0c231f723379d1b99030b02dc21023add904f3d6dcf59ddb906b0dee23529b7ffb9ed50e5e86151926860221f0e7352ae00000000"),
             "network_tx_base43_str": RawTx("3E2DH7.J3PKVZJ3RCOXQVS3Y./6-WE.75DDU0K58-0N1FRL565N8ZH-DG1Z.1IGWTE5HK8F7PWH5P8+V3XGZZ6GQBPHNDE+RD8CAQVV1/6PQEMJIZTGPMIJ93B8P$QX+Y2R:TGT9QW8S89U4N2.+FUT8VG+34USI/N/JJ3CE*KLSW:REE8T5Y*9:U6515JIUR$6TODLYHSDE3B5DAF:5TF7V*VAL3G40WBOM0DO2+CFKTTM$G-SO:8U0EW:M8V:4*R9ZDX$B1IRBP9PLMDK8H801PNTFB4$HL1+/U3F61P$4N:UAO88:N5D+J:HI4YR8IM:3A7K1YZ9VMRC/47$6GGW5JEL1N690TDQ4XW+TWHD:V.1.630QK*JN/.EITVU80YS3.8LWKO:2STLWZAVHUXFHQ..NZ0:.J/FTZM.KYDXIE1VBY7/:PHZMQ$.JZQ2.XT32440X/HM+UY/7QP4I+HTD9.DUSY-8R6HDR-B8/PF2NP7I2-MRW9VPW3U9.S0LQ.*221F8KVMD5ANJXZJ8WV4UFZ4R.$-NXVE+-FAL:WFERGU+WHJTHAP"),
             "network_tx_base43_bytes": RawTx(b"3E2DH7.J3PKVZJ3RCOXQVS3Y./6-WE.75DDU0K58-0N1FRL565N8ZH-DG1Z.1IGWTE5HK8F7PWH5P8+V3XGZZ6GQBPHNDE+RD8CAQVV1/6PQEMJIZTGPMIJ93B8P$QX+Y2R:TGT9QW8S89U4N2.+FUT8VG+34USI/N/JJ3CE*KLSW:REE8T5Y*9:U6515JIUR$6TODLYHSDE3B5DAF:5TF7V*VAL3G40WBOM0DO2+CFKTTM$G-SO:8U0EW:M8V:4*R9ZDX$B1IRBP9PLMDK8H801PNTFB4$HL1+/U3F61P$4N:UAO88:N5D+J:HI4YR8IM:3A7K1YZ9VMRC/47$6GGW5JEL1N690TDQ4XW+TWHD:V.1.630QK*JN/.EITVU80YS3.8LWKO:2STLWZAVHUXFHQ..NZ0:.J/FTZM.KYDXIE1VBY7/:PHZMQ$.JZQ2.XT32440X/HM+UY/7QP4I+HTD9.DUSY-8R6HDR-B8/PF2NP7I2-MRW9VPW3U9.S0LQ.*221F8KVMD5ANJXZJ8WV4UFZ4R.$-NXVE+-FAL:WFERGU+WHJTHAP"),
-            "network_tx_raw_bytes": RawTx(bytes.fromhex("0200000000010258e87a21b56daf0c23be8e7070456c336f7cbaa5c8757924f545887bb2abdd7500000000da00473044022074018ad4180097b873323c0015720b3684cc8123891048e7dbcd9b55ad679c99022073d369b740e3eb53dcefa33823c8070514ca55a7dd9544f157c167913261118c01483045022100f61038b308dc1da865a34852746f015772934208c6d24454393cd99bdf2217770220056e675a675a6d0a02b85b14e5e29074d8a25a9b5760bea2816f661910a006ea01475221029583bf39ae0a609747ad199addd634fa6108559d6c5cd39b4c2183f1ab96e07f2102dab61ff49a14db6a7d02b0cd1fbb78fc4b18312b5b4e54dae4dba2fbfef536d752aeffffffff838d0427d0ec650a68aa46bb0b098aea4422c071b2ca78352a077959d07cea1d01000000232200208c2353173743b595dfb4a07b72ba8e42e3797da74e87fe7d9d7497e3b2028903ffffffff0270aaf00800000000160014d85c2b71d0060b09c9886aeb815e50991dda124d00e1f5050000000016001400aea9a2e5f0f876a588df5546e8742d1d87008f000400473044022062eb7a556107a7c73f45ac4ab5a1dddf6f7075fb1275969a7f383efff784bcb202200c05dbb7470dbf2f08557dd356c7325c1ed30913e996cd3840945db12228da5f01473044022065f45ba5998b59a27ffe1a7bed016af1f1f90d54b3aa8f7450aa5f56a25103bd02207f724703ad1edb96680b284b56d4ffcb88f7fb759eabbe08aa30f29b851383d20147522103089dc10c7ac6db54f91329af617333db388cead0c231f723379d1b99030b02dc21023add904f3d6dcf59ddb906b0dee23529b7ffb9ed50e5e86151926860221f0e7352ae00000000"),
-                                          is_whitespace_allowed=False),
+            "network_tx_raw_bytes": RawTx(bytes.fromhex("0200000000010258e87a21b56daf0c23be8e7070456c336f7cbaa5c8757924f545887bb2abdd7500000000da00473044022074018ad4180097b873323c0015720b3684cc8123891048e7dbcd9b55ad679c99022073d369b740e3eb53dcefa33823c8070514ca55a7dd9544f157c167913261118c01483045022100f61038b308dc1da865a34852746f015772934208c6d24454393cd99bdf2217770220056e675a675a6d0a02b85b14e5e29074d8a25a9b5760bea2816f661910a006ea01475221029583bf39ae0a609747ad199addd634fa6108559d6c5cd39b4c2183f1ab96e07f2102dab61ff49a14db6a7d02b0cd1fbb78fc4b18312b5b4e54dae4dba2fbfef536d752aeffffffff838d0427d0ec650a68aa46bb0b098aea4422c071b2ca78352a077959d07cea1d01000000232200208c2353173743b595dfb4a07b72ba8e42e3797da74e87fe7d9d7497e3b2028903ffffffff0270aaf00800000000160014d85c2b71d0060b09c9886aeb815e50991dda124d00e1f5050000000016001400aea9a2e5f0f876a588df5546e8742d1d87008f000400473044022062eb7a556107a7c73f45ac4ab5a1dddf6f7075fb1275969a7f383efff784bcb202200c05dbb7470dbf2f08557dd356c7325c1ed30913e996cd3840945db12228da5f01473044022065f45ba5998b59a27ffe1a7bed016af1f1f90d54b3aa8f7450aa5f56a25103bd02207f724703ad1edb96680b284b56d4ffcb88f7fb759eabbe08aa30f29b851383d20147522103089dc10c7ac6db54f91329af617333db388cead0c231f723379d1b99030b02dc21023add904f3d6dcf59ddb906b0dee23529b7ffb9ed50e5e86151926860221f0e7352ae00000000")),
             "psbt_hex_str": RawTx("70736274ff01009a020000000258e87a21b56daf0c23be8e7070456c336f7cbaa5c8757924f545887bb2abdd750000000000ffffffff838d0427d0ec650a68aa46bb0b098aea4422c071b2ca78352a077959d07cea1d0100000000ffffffff0270aaf00800000000160014d85c2b71d0060b09c9886aeb815e50991dda124d00e1f5050000000016001400aea9a2e5f0f876a588df5546e8742d1d87008f00000000000100bb0200000001aad73931018bd25f84ae400b68848be09db706eac2ac18298babee71ab656f8b0000000048473044022058f6fc7c6a33e1b31548d481c826c015bd30135aad42cd67790dab66d2ad243b02204a1ced2604c6735b6393e5b41691dd78b00f0c5942fb9f751856faa938157dba01feffffff0280f0fa020000000017a9140fb9463421696b82c833af241c78c17ddbde493487d0f20a270100000017a91429ca74f8a08f81999428185c97b5d852e4063f6187650000000107da00473044022074018ad4180097b873323c0015720b3684cc8123891048e7dbcd9b55ad679c99022073d369b740e3eb53dcefa33823c8070514ca55a7dd9544f157c167913261118c01483045022100f61038b308dc1da865a34852746f015772934208c6d24454393cd99bdf2217770220056e675a675a6d0a02b85b14e5e29074d8a25a9b5760bea2816f661910a006ea01475221029583bf39ae0a609747ad199addd634fa6108559d6c5cd39b4c2183f1ab96e07f2102dab61ff49a14db6a7d02b0cd1fbb78fc4b18312b5b4e54dae4dba2fbfef536d752ae0001012000c2eb0b0000000017a914b7f5faf40e3d40a5a459b1db3535f2b72fa921e8870107232200208c2353173743b595dfb4a07b72ba8e42e3797da74e87fe7d9d7497e3b20289030108da0400473044022062eb7a556107a7c73f45ac4ab5a1dddf6f7075fb1275969a7f383efff784bcb202200c05dbb7470dbf2f08557dd356c7325c1ed30913e996cd3840945db12228da5f01473044022065f45ba5998b59a27ffe1a7bed016af1f1f90d54b3aa8f7450aa5f56a25103bd02207f724703ad1edb96680b284b56d4ffcb88f7fb759eabbe08aa30f29b851383d20147522103089dc10c7ac6db54f91329af617333db388cead0c231f723379d1b99030b02dc21023add904f3d6dcf59ddb906b0dee23529b7ffb9ed50e5e86151926860221f0e7352ae00220203a9a4c37f5996d3aa25dbac6b570af0650394492942460b354753ed9eeca5877110d90c6a4f000000800000008004000080002202027f6399757d2eff55a136ad02c684b1838b6556e5f1b6b34282a94b6b5005109610d90c6a4f00000080000000800500008000"),
             "psbt_hex_bytes": RawTx(b"70736274ff01009a020000000258e87a21b56daf0c23be8e7070456c336f7cbaa5c8757924f545887bb2abdd750000000000ffffffff838d0427d0ec650a68aa46bb0b098aea4422c071b2ca78352a077959d07cea1d0100000000ffffffff0270aaf00800000000160014d85c2b71d0060b09c9886aeb815e50991dda124d00e1f5050000000016001400aea9a2e5f0f876a588df5546e8742d1d87008f00000000000100bb0200000001aad73931018bd25f84ae400b68848be09db706eac2ac18298babee71ab656f8b0000000048473044022058f6fc7c6a33e1b31548d481c826c015bd30135aad42cd67790dab66d2ad243b02204a1ced2604c6735b6393e5b41691dd78b00f0c5942fb9f751856faa938157dba01feffffff0280f0fa020000000017a9140fb9463421696b82c833af241c78c17ddbde493487d0f20a270100000017a91429ca74f8a08f81999428185c97b5d852e4063f6187650000000107da00473044022074018ad4180097b873323c0015720b3684cc8123891048e7dbcd9b55ad679c99022073d369b740e3eb53dcefa33823c8070514ca55a7dd9544f157c167913261118c01483045022100f61038b308dc1da865a34852746f015772934208c6d24454393cd99bdf2217770220056e675a675a6d0a02b85b14e5e29074d8a25a9b5760bea2816f661910a006ea01475221029583bf39ae0a609747ad199addd634fa6108559d6c5cd39b4c2183f1ab96e07f2102dab61ff49a14db6a7d02b0cd1fbb78fc4b18312b5b4e54dae4dba2fbfef536d752ae0001012000c2eb0b0000000017a914b7f5faf40e3d40a5a459b1db3535f2b72fa921e8870107232200208c2353173743b595dfb4a07b72ba8e42e3797da74e87fe7d9d7497e3b20289030108da0400473044022062eb7a556107a7c73f45ac4ab5a1dddf6f7075fb1275969a7f383efff784bcb202200c05dbb7470dbf2f08557dd356c7325c1ed30913e996cd3840945db12228da5f01473044022065f45ba5998b59a27ffe1a7bed016af1f1f90d54b3aa8f7450aa5f56a25103bd02207f724703ad1edb96680b284b56d4ffcb88f7fb759eabbe08aa30f29b851383d20147522103089dc10c7ac6db54f91329af617333db388cead0c231f723379d1b99030b02dc21023add904f3d6dcf59ddb906b0dee23529b7ffb9ed50e5e86151926860221f0e7352ae00220203a9a4c37f5996d3aa25dbac6b570af0650394492942460b354753ed9eeca5877110d90c6a4f000000800000008004000080002202027f6399757d2eff55a136ad02c684b1838b6556e5f1b6b34282a94b6b5005109610d90c6a4f00000080000000800500008000"),
             "psbt_base64_str": RawTx("cHNidP8BAJoCAAAAAljoeiG1ba8MI76OcHBFbDNvfLqlyHV5JPVFiHuyq911AAAAAAD/////g40EJ9DsZQpoqka7CwmK6kQiwHGyyng1Kgd5WdB86h0BAAAAAP////8CcKrwCAAAAAAWABTYXCtx0AYLCcmIauuBXlCZHdoSTQDh9QUAAAAAFgAUAK6pouXw+HaliN9VRuh0LR2HAI8AAAAAAAEAuwIAAAABqtc5MQGL0l+ErkALaISL4J23BurCrBgpi6vucatlb4sAAAAASEcwRAIgWPb8fGoz4bMVSNSByCbAFb0wE1qtQs1neQ2rZtKtJDsCIEoc7SYExnNbY5PltBaR3XiwDwxZQvufdRhW+qk4FX26Af7///8CgPD6AgAAAAAXqRQPuUY0IWlrgsgzryQceMF9295JNIfQ8gonAQAAABepFCnKdPigj4GZlCgYXJe12FLkBj9hh2UAAAABAwQBAAAAAQRHUiEClYO/Oa4KYJdHrRma3dY0+mEIVZ1sXNObTCGD8auW4H8hAtq2H/SaFNtqfQKwzR+7ePxLGDErW05U2uTbovv+9TbXUq4iBgKVg785rgpgl0etGZrd1jT6YQhVnWxc05tMIYPxq5bgfxDZDGpPAAAAgAAAAIAAAACAIgYC2rYf9JoU22p9ArDNH7t4/EsYMStbTlTa5Nui+/71NtcQ2QxqTwAAAIAAAACAAQAAgAABASAAwusLAAAAABepFLf1+vQOPUClpFmx2zU18rcvqSHohwEDBAEAAAABBCIAIIwjUxc3Q7WV37Sge3K6jkLjeX2nTof+fZ10l+OyAokDAQVHUiEDCJ3BDHrG21T5EymvYXMz2ziM6tDCMfcjN50bmQMLAtwhAjrdkE89bc9Z3bkGsN7iNSm3/7ntUOXoYVGSaGAiHw5zUq4iBgI63ZBPPW3PWd25BrDe4jUpt/+57VDl6GFRkmhgIh8OcxDZDGpPAAAAgAAAAIADAACAIgYDCJ3BDHrG21T5EymvYXMz2ziM6tDCMfcjN50bmQMLAtwQ2QxqTwAAAIAAAACAAgAAgAAiAgOppMN/WZbTqiXbrGtXCvBlA5RJKUJGCzVHU+2e7KWHcRDZDGpPAAAAgAAAAIAEAACAACICAn9jmXV9Lv9VoTatAsaEsYOLZVbl8bazQoKpS2tQBRCWENkMak8AAACAAAAAgAUAAIAA"),
             "psbt_base64_bytes": RawTx(b"cHNidP8BAJoCAAAAAljoeiG1ba8MI76OcHBFbDNvfLqlyHV5JPVFiHuyq911AAAAAAD/////g40EJ9DsZQpoqka7CwmK6kQiwHGyyng1Kgd5WdB86h0BAAAAAP////8CcKrwCAAAAAAWABTYXCtx0AYLCcmIauuBXlCZHdoSTQDh9QUAAAAAFgAUAK6pouXw+HaliN9VRuh0LR2HAI8AAAAAAAEAuwIAAAABqtc5MQGL0l+ErkALaISL4J23BurCrBgpi6vucatlb4sAAAAASEcwRAIgWPb8fGoz4bMVSNSByCbAFb0wE1qtQs1neQ2rZtKtJDsCIEoc7SYExnNbY5PltBaR3XiwDwxZQvufdRhW+qk4FX26Af7///8CgPD6AgAAAAAXqRQPuUY0IWlrgsgzryQceMF9295JNIfQ8gonAQAAABepFCnKdPigj4GZlCgYXJe12FLkBj9hh2UAAAABAwQBAAAAAQRHUiEClYO/Oa4KYJdHrRma3dY0+mEIVZ1sXNObTCGD8auW4H8hAtq2H/SaFNtqfQKwzR+7ePxLGDErW05U2uTbovv+9TbXUq4iBgKVg785rgpgl0etGZrd1jT6YQhVnWxc05tMIYPxq5bgfxDZDGpPAAAAgAAAAIAAAACAIgYC2rYf9JoU22p9ArDNH7t4/EsYMStbTlTa5Nui+/71NtcQ2QxqTwAAAIAAAACAAQAAgAABASAAwusLAAAAABepFLf1+vQOPUClpFmx2zU18rcvqSHohwEDBAEAAAABBCIAIIwjUxc3Q7WV37Sge3K6jkLjeX2nTof+fZ10l+OyAokDAQVHUiEDCJ3BDHrG21T5EymvYXMz2ziM6tDCMfcjN50bmQMLAtwhAjrdkE89bc9Z3bkGsN7iNSm3/7ntUOXoYVGSaGAiHw5zUq4iBgI63ZBPPW3PWd25BrDe4jUpt/+57VDl6GFRkmhgIh8OcxDZDGpPAAAAgAAAAIADAACAIgYDCJ3BDHrG21T5EymvYXMz2ziM6tDCMfcjN50bmQMLAtwQ2QxqTwAAAIAAAACAAgAAgAAiAgOppMN/WZbTqiXbrGtXCvBlA5RJKUJGCzVHU+2e7KWHcRDZDGpPAAAAgAAAAIAEAACAACICAn9jmXV9Lv9VoTatAsaEsYOLZVbl8bazQoKpS2tQBRCWENkMak8AAACAAAAAgAUAAIAA"),
             "psbt_base43_str": RawTx("EFS+4WQ2R.5QWTVLQS.BWHG21Q-M0HVA+KKLG+9RYJ2B/GHJ$3OUOKH32U0NISGM$CI*KI24$PKQI0F*GA..*DW:UJ4FM-6S3B*VIJ0.M8M*DVCR9+TNG2R/IMZY0A72MS8+QMTO*:25V577L*DRC78WBK0BNAK7/8JQR-FA/L-KNBBKTQRZEU93T/Z/.7OBC6A7WWZ49DNHLG:X37ISM2+.ZT4ZC00.G8K8O6NM48GRR+N/-W/ASXT5VLPPHPRWR2PHMLZWDYAN8DMW$1EKD/EU4LHQWIKM0N42B*/32MQ1C:I17FMQVVQF6OA*X1RW8X.H17040FPH8/L5HBPFTTT0PMJGR9I0/J0+4PS5WJE/:W-Y.YA:SMFZMO36IMK0P/KUHVR.44OPT$TD*ZHSPZVULFWH75T+APO636*NYL19ZJIU3N37$KN7OY7*WOA498BWCPM$G6::C:YPDZ:PUISTZB-RL**B/QAX+HA*55O+:R/L8*J9B*G:QU6FS+HS+:OXPKOP-GDJK$NU72E4Y11BZENGIJWLWZ+C:01G$H-*LY5.LGC5I1A4G7$KT9BZ81LEPV5D09RAKI5BW1*O8QWMIIG17/8$J0X:W7F9FC7EMQRLESY2NNNVLZTHWB/FJVB-*.5JU0GQ*3JIBTQ$OR3AHTJ-U-C-8MWV$R::*VTRY-2+*H7U594$0JCN27R9*TY0+8:3Q7T/HES5OF*GLL::5Z8M$JNCLLKH6:J:GCT$E:27AXUA1L4ROJO3*-86C2QH.9TBNP0SS51XRL/J7:-+QES+37SOZIJCKG2XOUVPJR:F+MGS1L6-8/YA.6BKZ+FMF8F:OT2P4X:9M4P8IGM-/UUSS8S5*8YMZ$S+JKY.DHDCY$$+F53TGYK1.RHYA68-KO3O:$$IO/R9995TPAE6FF6$UOAUD5A2YLY.Q$VE$Q*0437K-DHKRFM$Q$3G:58+GER9D.6S$EW++HBBE0T62MAA/$-A2OV22QHY.JHK:6GNT.QQ*5YWZKCZI$+IQPU0UT/0H0PR9BYB1BB-Y+A.Q2HD$JP+:AT0CQR$R3PVHC9K/IPTVWJK0J4$J-B-CL6713L5PM-33-.CHXGJ$*ME.U-71V2JNX*W7JYC$V2VEEL:3GU3HGV84O.5PT+K*NB/2.-0.GCQNJ*ZOC$M2Y86V:URJ4/.ZVK6X1I--.B9NAWE54IDPLRN0FSWYGA/INDLPUBW7SZ/YADHWFLU*MWI121O2Y56QWG.EFNLSIVAVXYF$.:N/OU-PS7U/*Z94CR7T0+.F+RL9.-U5FQ1QL/A2$O2E0$TP-AX4*55QET9BPH6:K+CD$.+$*F0BUWSW.*$IF*WIC+UMJRZP5.50V1DMTIZ.D/2+$0T-GDBE7LHPGY0X0:G/*ZPTAMQABEC4HPML4UCLSAR-.5UT-X1.PMM60HUFAF"),
             "psbt_base43_bytes": RawTx(b'EFS+4WQ2R.5QWTVLQS.BWHG21Q-M0HVA+KKLG+9RYJ2B/GHJ$3OUOKH32U0NISGM$CI*KI24$PKQI0F*GA..*DW:UJ4FM-6S3B*VIJ0.M8M*DVCR9+TNG2R/IMZY0A72MS8+QMTO*:25V577L*DRC78WBK0BNAK7/8JQR-FA/L-KNBBKTQRZEU93T/Z/.7OBC6A7WWZ49DNHLG:X37ISM2+.ZT4ZC00.G8K8O6NM48GRR+N/-W/ASXT5VLPPHPRWR2PHMLZWDYAN8DMW$1EKD/EU4LHQWIKM0N42B*/32MQ1C:I17FMQVVQF6OA*X1RW8X.H17040FPH8/L5HBPFTTT0PMJGR9I0/J0+4PS5WJE/:W-Y.YA:SMFZMO36IMK0P/KUHVR.44OPT$TD*ZHSPZVULFWH75T+APO636*NYL19ZJIU3N37$KN7OY7*WOA498BWCPM$G6::C:YPDZ:PUISTZB-RL**B/QAX+HA*55O+:R/L8*J9B*G:QU6FS+HS+:OXPKOP-GDJK$NU72E4Y11BZENGIJWLWZ+C:01G$H-*LY5.LGC5I1A4G7$KT9BZ81LEPV5D09RAKI5BW1*O8QWMIIG17/8$J0X:W7F9FC7EMQRLESY2NNNVLZTHWB/FJVB-*.5JU0GQ*3JIBTQ$OR3AHTJ-U-C-8MWV$R::*VTRY-2+*H7U594$0JCN27R9*TY0+8:3Q7T/HES5OF*GLL::5Z8M$JNCLLKH6:J:GCT$E:27AXUA1L4ROJO3*-86C2QH.9TBNP0SS51XRL/J7:-+QES+37SOZIJCKG2XOUVPJR:F+MGS1L6-8/YA.6BKZ+FMF8F:OT2P4X:9M4P8IGM-/UUSS8S5*8YMZ$S+JKY.DHDCY$$+F53TGYK1.RHYA68-KO3O:$$IO/R9995TPAE6FF6$UOAUD5A2YLY.Q$VE$Q*0437K-DHKRFM$Q$3G:58+GER9D.6S$EW++HBBE0T62MAA/$-A2OV22QHY.JHK:6GNT.QQ*5YWZKCZI$+IQPU0UT/0H0PR9BYB1BB-Y+A.Q2HD$JP+:AT0CQR$R3PVHC9K/IPTVWJK0J4$J-B-CL6713L5PM-33-.CHXGJ$*ME.U-71V2JNX*W7JYC$V2VEEL:3GU3HGV84O.5PT+K*NB/2.-0.GCQNJ*ZOC$M2Y86V:URJ4/.ZVK6X1I--.B9NAWE54IDPLRN0FSWYGA/INDLPUBW7SZ/YADHWFLU*MWI121O2Y56QWG.EFNLSIVAVXYF$.:N/OU-PS7U/*Z94CR7T0+.F+RL9.-U5FQ1QL/A2$O2E0$TP-AX4*55QET9BPH6:K+CD$.+$*F0BUWSW.*$IF*WIC+UMJRZP5.50V1DMTIZ.D/2+$0T-GDBE7LHPGY0X0:G/*ZPTAMQABEC4HPML4UCLSAR-.5UT-X1.PMM60HUFAF'),
-            "psbt_raw_bytes": RawTx(bytes.fromhex("70736274ff01009a020000000258e87a21b56daf0c23be8e7070456c336f7cbaa5c8757924f545887bb2abdd750000000000ffffffff838d0427d0ec650a68aa46bb0b098aea4422c071b2ca78352a077959d07cea1d0100000000ffffffff0270aaf00800000000160014d85c2b71d0060b09c9886aeb815e50991dda124d00e1f5050000000016001400aea9a2e5f0f876a588df5546e8742d1d87008f00000000000100bb0200000001aad73931018bd25f84ae400b68848be09db706eac2ac18298babee71ab656f8b0000000048473044022058f6fc7c6a33e1b31548d481c826c015bd30135aad42cd67790dab66d2ad243b02204a1ced2604c6735b6393e5b41691dd78b00f0c5942fb9f751856faa938157dba01feffffff0280f0fa020000000017a9140fb9463421696b82c833af241c78c17ddbde493487d0f20a270100000017a91429ca74f8a08f81999428185c97b5d852e4063f6187650000000107da00473044022074018ad4180097b873323c0015720b3684cc8123891048e7dbcd9b55ad679c99022073d369b740e3eb53dcefa33823c8070514ca55a7dd9544f157c167913261118c01483045022100f61038b308dc1da865a34852746f015772934208c6d24454393cd99bdf2217770220056e675a675a6d0a02b85b14e5e29074d8a25a9b5760bea2816f661910a006ea01475221029583bf39ae0a609747ad199addd634fa6108559d6c5cd39b4c2183f1ab96e07f2102dab61ff49a14db6a7d02b0cd1fbb78fc4b18312b5b4e54dae4dba2fbfef536d752ae0001012000c2eb0b0000000017a914b7f5faf40e3d40a5a459b1db3535f2b72fa921e8870107232200208c2353173743b595dfb4a07b72ba8e42e3797da74e87fe7d9d7497e3b20289030108da0400473044022062eb7a556107a7c73f45ac4ab5a1dddf6f7075fb1275969a7f383efff784bcb202200c05dbb7470dbf2f08557dd356c7325c1ed30913e996cd3840945db12228da5f01473044022065f45ba5998b59a27ffe1a7bed016af1f1f90d54b3aa8f7450aa5f56a25103bd02207f724703ad1edb96680b284b56d4ffcb88f7fb759eabbe08aa30f29b851383d20147522103089dc10c7ac6db54f91329af617333db388cead0c231f723379d1b99030b02dc21023add904f3d6dcf59ddb906b0dee23529b7ffb9ed50e5e86151926860221f0e7352ae00220203a9a4c37f5996d3aa25dbac6b570af0650394492942460b354753ed9eeca5877110d90c6a4f000000800000008004000080002202027f6399757d2eff55a136ad02c684b1838b6556e5f1b6b34282a94b6b5005109610d90c6a4f00000080000000800500008000"),
-                                    is_whitespace_allowed=False),
+            "psbt_raw_bytes": RawTx(bytes.fromhex("70736274ff01009a020000000258e87a21b56daf0c23be8e7070456c336f7cbaa5c8757924f545887bb2abdd750000000000ffffffff838d0427d0ec650a68aa46bb0b098aea4422c071b2ca78352a077959d07cea1d0100000000ffffffff0270aaf00800000000160014d85c2b71d0060b09c9886aeb815e50991dda124d00e1f5050000000016001400aea9a2e5f0f876a588df5546e8742d1d87008f00000000000100bb0200000001aad73931018bd25f84ae400b68848be09db706eac2ac18298babee71ab656f8b0000000048473044022058f6fc7c6a33e1b31548d481c826c015bd30135aad42cd67790dab66d2ad243b02204a1ced2604c6735b6393e5b41691dd78b00f0c5942fb9f751856faa938157dba01feffffff0280f0fa020000000017a9140fb9463421696b82c833af241c78c17ddbde493487d0f20a270100000017a91429ca74f8a08f81999428185c97b5d852e4063f6187650000000107da00473044022074018ad4180097b873323c0015720b3684cc8123891048e7dbcd9b55ad679c99022073d369b740e3eb53dcefa33823c8070514ca55a7dd9544f157c167913261118c01483045022100f61038b308dc1da865a34852746f015772934208c6d24454393cd99bdf2217770220056e675a675a6d0a02b85b14e5e29074d8a25a9b5760bea2816f661910a006ea01475221029583bf39ae0a609747ad199addd634fa6108559d6c5cd39b4c2183f1ab96e07f2102dab61ff49a14db6a7d02b0cd1fbb78fc4b18312b5b4e54dae4dba2fbfef536d752ae0001012000c2eb0b0000000017a914b7f5faf40e3d40a5a459b1db3535f2b72fa921e8870107232200208c2353173743b595dfb4a07b72ba8e42e3797da74e87fe7d9d7497e3b20289030108da0400473044022062eb7a556107a7c73f45ac4ab5a1dddf6f7075fb1275969a7f383efff784bcb202200c05dbb7470dbf2f08557dd356c7325c1ed30913e996cd3840945db12228da5f01473044022065f45ba5998b59a27ffe1a7bed016af1f1f90d54b3aa8f7450aa5f56a25103bd02207f724703ad1edb96680b284b56d4ffcb88f7fb759eabbe08aa30f29b851383d20147522103089dc10c7ac6db54f91329af617333db388cead0c231f723379d1b99030b02dc21023add904f3d6dcf59ddb906b0dee23529b7ffb9ed50e5e86151926860221f0e7352ae00220203a9a4c37f5996d3aa25dbac6b570af0650394492942460b354753ed9eeca5877110d90c6a4f000000800000008004000080002202027f6399757d2eff55a136ad02c684b1838b6556e5f1b6b34282a94b6b5005109610d90c6a4f00000080000000800500008000")),
         }
         whitespace_str = " \r\n  \n  "
         whitespace_bytes = b" \r\n  \n  "
         for case_name, raw_tx in raw_tx_map.items():
-            for has_whitespaces in (False, True):
-                with self.subTest(msg=case_name, has_whitespaces=has_whitespaces):
-                    if not has_whitespaces:
-                        data = raw_tx.data
-                        tx_from_any(data)  # test if raises (should not)
-                    else:
-                        if isinstance(raw_tx.data, str):
-                            mid = len(raw_tx.data) // 2  # for str, sprinkle whitespaces all over
-                            data = whitespace_str + raw_tx.data[:mid] + whitespace_str + raw_tx.data[mid:] + whitespace_str
-                        else:  # bytes only tolerate whitespaces that are leading/trailing
-                            data = whitespace_bytes + raw_tx.data + whitespace_bytes
-                        if raw_tx.is_whitespace_allowed:
-                            tx_from_any(data)  # test if raises (should not)
-                        else:
-                            with self.assertRaises(transaction.SerializationError):
-                                tx_from_any(data)  # test if raises (should)
+            with self.subTest(msg=case_name, has_whitespaces=False):
+                data = raw_tx.data
+                tx_from_any(data)  # test if raises (should not)
+            with self.subTest(msg=case_name, has_whitespaces=True):
+                mid = len(raw_tx.data) // 2
+                if isinstance(raw_tx.data, str):
+                    # for str, sprinkle whitespaces all over
+                    data = whitespace_str + raw_tx.data[:mid] + whitespace_str + raw_tx.data[mid:] + whitespace_str
+                    tx_from_any(data)  # test if raises (should not)
+                else:
+                    assert isinstance(raw_tx.data, bytes)
+                    # whitespace leading/trailing
+                    data = whitespace_bytes + raw_tx.data + whitespace_bytes
+                    with self.assertRaises(transaction.SerializationError):
+                        tx_from_any(data)  # should raise
+                    # whitespace in middle
+                    data = raw_tx.data[:mid] + whitespace_bytes + raw_tx.data[mid:]
+                    with self.assertRaises(transaction.SerializationError):
+                        tx_from_any(data)  # should raise
 
 #####

Risk score

Why this scored 44/100

Our methodology →

Potential impact 12/30

Exploitability 8/25

Stealth signal 6/15

Affected reach 7/15

Confidence 7/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 44/100

Community notes

Related watches

wallet: sign_message: strip whitespaces in GUIs, do not strip in CLI

qml: strip whitespace from message before signing, as in qt gui

trezor: drop session after closing it