What the developer wrote
Authored by copronista
Update plugin.py
https://github.com/spesmilo/electrum/issues/10220
What changed, and why it matters
This commit changes how Electrum opens files inside external plugin ZIP archives. Previously it used the operating system's file-path joiner, which on Windows uses backslashes. ZIP archive entries always use forward-slash separators, so on Windows the old code could fail to find the requested file or behave unexpectedly. The fix forces forward slashes, making plugin file lookup reliable across all platforms. The linked issue suggests this caused a real bug, possibly a crash or broken plugin loading, but the commit message does not explicitly call it a security vulnerability.
Treat as a bug fix with possible security side-effects on Windows. Review issue #10220 for exploitability details, test external plugin loading on Windows, and consider whether additional validation of ZIP entry names is needed to prevent path traversal in plugin archives.
Security signals we found
Cross-platform path separator mismatch in ZIP entry lookup
External plugin ZIP file handling code changed
Linked GitHub issue #10220 suggests user-reported bug
Potential for plugin loading failure or unexpected behavior on Windows
Evidence from the diff
In electrum/plugin.py, Plugins.read_file() was constructing the ZIP entry name with os.path.join(dirname, filename). On Windows, os.path.join produces backslash-separated paths (e.g., ‘plugin\file.py’), which do not match ZIP entry names that use forward slashes. The patch replaces that with ‘/’.join([dirname, filename]) so the entry name is always ZIP-correct. This is a cross-platform path-handling bug fix. It could affect plugin loading integrity on Windows, and in some ZIP libraries malformed entry names can lead to traversal or unexpected behavior, but the diff itself is a straightforward correctness fix rather than a clear security patch.
Changed components
electrum/plugin.pyPlugins.read_file()External plugin ZIP loadingInspect captured patch +1 / −1
diff --git a/electrum/plugin.py b/electrum/plugin.py
index 8d161f8..021df3e 100644
--- a/electrum/plugin.py
+++ b/electrum/plugin.py
@@ -794,7 +794,7 @@ class Plugins(DaemonThread):
metadata = self.external_plugin_metadata[name]
dirname = metadata['dirname']
with zipfile_lib.ZipFile(plugin_filename) as myzip:
- with myzip.open(os.path.join(dirname, filename)) as myfile:
+ with myzip.open("/".join([dirname,filename])) as myfile:
return myfile.read()
elif name in self.internal_plugin_metadata:
path = os.path.join(os.path.dirname(__file__), 'plugins', name, filename)
Why this scored 62/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.