qt gui: more defensive 'gui' RPC (i.e. URI) handling
What the developer wrote
Authored by SomberNight
qt gui: more defensive 'gui' RPC (i.e. URI) handling
What changed, and why it matters
This commit hardens how the Electrum desktop wallet handles Bitcoin payment URIs received through its internal RPC interface. Before the change, an attacker who could already talk to Electrum's local RPC server might be able to silently change the recipient and amount on the user's Send tab while the user was in the middle of creating a different payment. The patch now shows a notification, clears the existing payment fields, and then fills in the new URI, making the change visible and preventing leftover values (such as an amount from a previous payment) from being reused unexpectedly.
Treat as a low-to-moderate hardening improvement rather than a critical vulnerability fix. Users running Electrum with RPC enabled should ensure the RPC port is not exposed to untrusted local users or other machines, since this patch does not change RPC access controls. Review whether additional hardening (e.g., URI confirmation dialog, RPC authentication/authorization) is warranted.
Security signals we found
Defensive hardening of RPC-triggered URI handling
Commit message describes threat model: local attacker with RPC/config access
Prevents stale Send-tab fields from being combined with attacker-supplied URI
Adds user-visible notification when URI is processed
No CVE, advisory, or researcher attribution present in commit materials
Evidence from the diff
The change is in electrum/gui/qt/init.py inside the GUI’s URI/RPC handler. When a bitcoin: URI is delivered to an already-open wallet window, the code now calls window.notify() to inform the user, window.send_tab.do_clear() to reset all Send-tab fields, and only then window.send_tab.set_payment_identifier(uri). The commit message explicitly frames this as ‘defensive’ against a ‘local attacker with access to RPC server and config file’. The patch is purely a UX-hardening measure; it does not add authentication or otherwise restrict RPC access.
Changed components
electrum/gui/qt/__init__.pyQt GUI Send tabInternal RPC/URI handling pathInspect captured patch +8 / −0
diff --git a/electrum/gui/qt/__init__.py b/electrum/gui/qt/__init__.py
index 9c15154..38a8a95 100644
--- a/electrum/gui/qt/__init__.py
+++ b/electrum/gui/qt/__init__.py
@@ -439,6 +439,14 @@ class ElectrumGui(BaseElectrumGui, Logger):
window.activateWindow()
if uri:
window.show_send_tab()
+ # Handle URI defensively - local attacker with access to RPC server and config file could get here:
+ # - tell user something happened
+ window.notify(_("Updated 'Pay To' field to handle external URI"))
+ # - clear all fields in Send tab:
+ # - perhaps user was just filling out the fields, trying to make another payment.
+ # e.g. if the given URI does not have an amount, we should clear the amount field
+ window.send_tab.do_clear()
+ # - update "Pay To" field (and maybe others)
window.send_tab.set_payment_identifier(uri)
return window
Why this scored 53/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.