qeqrscanner: check requestCode on activity result
What the developer wrote
Authored by f321x
qeqrscanner: check requestCode on activity result
What changed, and why it matters
This commit fixes the Android QR scanner in Electrum so it checks which app-request ID is returned before processing a scanned result. Previously the scanner used a hardcoded request code of 0, which could let a malicious or confused app feed fake QR scan results into Electrum by returning an activity result with the same default code. The fix gives Electrum a unique, randomly chosen request code and ignores any result that does not match it.
Treat as a security hardening fix and include in release notes. Users on Android should update to a release containing this commit. No immediate emergency response is indicated because the commit does not disclose an active exploit, but app developers should audit other startActivityForResult callers for the same pattern.
Security signals we found
request-code validation added to Android activity result handler
hardcoded default request code 0 replaced with unique constant
potential cross-component intent/activity-result confusion mitigated
no explicit security advisory or CVE referenced in commit
Evidence from the diff
In electrum/gui/qml/qeqrscanner.py the QEQRScanner class previously launched the external QR scanner activity with startActivityForResult(intent, 0) and handled every on_activity_result callback without validating requestCode. Because 0 is a common default request code, another component could return a result that Electrum would treat as a valid QR scan. The patch defines a class-specific REQUEST_CODE_SIMPLE_SCANNER_ACTIVITY = 30368, passes it to startActivityForResult, and returns early from on_qr_activity_result if requestCode does not match. This is a request-code-confusion/result-injection hardening fix.
Changed components
electrum/gui/qml/qeqrscanner.pyAndroid QR scanner activity result handlingInspect captured patch +6 / −1
diff --git a/electrum/gui/qml/qeqrscanner.py b/electrum/gui/qml/qeqrscanner.py
index 297479b..f7ed883 100644
--- a/electrum/gui/qml/qeqrscanner.py
+++ b/electrum/gui/qml/qeqrscanner.py
@@ -19,6 +19,8 @@ if 'ANDROID_DATA' in os.environ:
class QEQRScanner(QObject):
+ REQUEST_CODE_SIMPLE_SCANNER_ACTIVITY = 30368 # random 16 bit int
+
_logger = get_logger(__name__)
foundText = pyqtSignal(str)
@@ -54,9 +56,12 @@ class QEQRScanner(QObject):
intent.putExtra(jIntent.EXTRA_TEXT, jString(self._hint))
activity.bind(on_activity_result=self.on_qr_activity_result)
- jpythonActivity.startActivityForResult(intent, 0)
+ jpythonActivity.startActivityForResult(intent, self.REQUEST_CODE_SIMPLE_SCANNER_ACTIVITY)
def on_qr_activity_result(self, requestCode, resultCode, intent):
+ if requestCode != self.REQUEST_CODE_SIMPLE_SCANNER_ACTIVITY:
+ self._logger.warning(f"got activity result with invalid {requestCode=}")
+ return
try:
if resultCode == -1: # RESULT_OK:
if (contents := intent.getStringExtra(jString("text"))) is not None:
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.