qml: explicitly opt-in to RichText where used
What the developer wrote
Authored by SomberNight
qml: explicitly opt-in to RichText where used
What changed, and why it matters
This commit adds explicit 'RichText' formatting markers to several user-interface text labels in Electrum's QML (mobile-style) GUI. Previously these labels may have implicitly rendered HTML-like tags. The change is a cleanup/adaptation to newer Qt behavior and does not, on its own, introduce a security vulnerability. It is not a fix for a known exploit, but it touches code that handles rich text rendering, which can be security-relevant if untrusted strings are later inserted.
Review whether any of these rich-text labels ever display attacker-influenced data (e.g., exception messages from network peers, wallet filenames from external sources, transaction memos). If so, ensure the data is sanitized or use `Text.PlainText`/`Text.StyledText` instead. Otherwise no immediate action is required.
Security signals we found
RichText / HTML rendering in UI components
Labels display wallet metadata (name, amount, exception report text)
No input sanitization or escaping changes present in diff
Evidence from the diff
The patch sets textFormat: Text.RichText on six QML Label/InfoTextArea items that already contain HTML-style markup (<b>, <br/>, <). In Qt Quick, the default text format changed over versions; explicitly opting in avoids markup being displayed literally or being misinterpreted. The strings shown are either hard-coded/translated UI text or wallet-derived values (amounts, names), not obviously attacker-controlled. There is no sanitization change or input validation change in this diff.
Changed components
electrum/gui/qml/components/ExceptionDialog.qmlelectrum/gui/qml/components/OpenWalletDialog.qmlelectrum/gui/qml/components/Preferences.qmlelectrum/gui/qml/components/controls/TxInput.qmlelectrum/gui/qml/components/wizard/WCCreateSeed.qmlelectrum/gui/qml/components/wizard/WCEnterExt.qmlInspect captured patch +6 / −0
### electrum/gui/qml/components/ExceptionDialog.qml
@@ -131,6 +131,7 @@ ElDialog
text: reportText
wrapMode: Text.Wrap
width: parent.width
+ textFormat: Text.RichText
}
}
onClosed: destroy()
### electrum/gui/qml/components/OpenWalletDialog.qml
@@ -46,6 +46,7 @@ ElDialog {
text: Daemon.singlePasswordEnabled || isStartup
? qsTr('Please enter password')
: qsTr('Wallet <b>%1</b> requires password to unlock').arg(name)
+ textFormat: Text.RichText
compact: true
iconStyle: InfoTextArea.IconStyle.Info
backgroundColor: constants.darkerDialogBackground
### electrum/gui/qml/components/Preferences.qml
@@ -369,6 +369,7 @@ Pane {
Label {
Layout.fillWidth: true
text: qsTr('<b>%1%</b> of payment').arg(maxfeeslider._fees[maxfeeslider.value]/10000)
+ textFormat: Text.RichText
wrapMode: Text.Wrap
}
### electrum/gui/qml/components/controls/TxInput.qml
@@ -42,6 +42,7 @@ TextHighlightPane {
: '<' + qsTr('unknown amount') + '>'
font.pixelSize: constants.fontSizeMedium
font.family: FixedFont
+ textFormat: Text.RichText
}
Label {
text: Config.baseUnit
### electrum/gui/qml/components/wizard/WCCreateSeed.qml
@@ -49,6 +49,7 @@ WizardComponent {
Layout.fillWidth: true
backgroundColor: constants.darkerDialogBackground
iconStyle: InfoTextArea.IconStyle.Warn
+ textFormat: Text.RichText
}
Label {
### electrum/gui/qml/components/wizard/WCEnterExt.qml
@@ -76,6 +76,7 @@ WizardComponent {
'<br/>',
qsTr('Do not enable it unless you know what it does!'),
].join(' ')
+ textFormat: Text.RichText
}
ElCheckBox {Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.