What the developer wrote
Authored by SomberNight
locale: don't translate URL, like wtf
please, use common sense :(
I guess it was a copy-paste error, but still, treat all _() and qsTr() calls as "scary" and as potential attack vectors. Don't blindly call _(): every call needs to be weighed separately.
What changed, and why it matters
This commit removes translation markup from a hardcoded web link in Electrum's 'About' screen. The developer's message warns that translation functions can be risky because malicious or compromised translators could alter URLs or inject harmful content. The actual change is very small and only affects a single, trusted URL label, so the direct security risk is low, but the commit reflects a broader defensive-coding concern.
Treat as a minor hardening commit. Review other qsTr() and _() calls that wrap rich text, URLs, or HTML to ensure translated strings cannot alter links or inject markup. No urgent user action is required for this specific change.
Security signals we found
Removal of translation wrapper from rich-text URL
Developer note explicitly flags _()/qsTr() as potential attack vectors
RichText + external URL opening in QML component
Defensive hardening rather than fix for active vulnerability
Evidence from the diff
In electrum/gui/qml/components/About.qml, the qsTr() wrapper around an HTML anchor for https://electrum.org was removed. qsTr() marks strings for translation and returns a translated version at runtime. Because the string contains rich text (textFormat: Text.RichText) and is used with an onLinkActivated handler that opens the link externally, a malicious translation could change the href, display text, or inject other HTML. The patch hardcodes the English string, eliminating the translation attack surface for this specific label. The URL itself remains unchanged.
Changed components
electrum/gui/qml/components/About.qmlAbout dialog in Electrum's QML GUIInspect captured patch +1 / −1
diff --git a/electrum/gui/qml/components/About.qml b/electrum/gui/qml/components/About.qml
index b5736d5..47bf890 100644
--- a/electrum/gui/qml/components/About.qml
+++ b/electrum/gui/qml/components/About.qml
@@ -72,7 +72,7 @@ Pane {
Layout.alignment: Qt.AlignRight
}
Label {
- text: qsTr('<a href="https://electrum.org">https://electrum.org</a>')
+ text: '<a href="https://electrum.org">https://electrum.org</a>'
textFormat: Text.RichText
onLinkActivated: Qt.openUrlExternally(link)
}
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.