crash_reporter: flag reports where console was used in app_version
What the developer wrote
Authored by SomberNight
crash_reporter: flag reports where console was used in app_version
so we don't waste time on weird reports where the user modified
internals at runtime
ref
https://github.com/spesmilo/electrum/issues/10217
https://github.com/spesmilo/electrum/issues/10218
What changed, and why it matters
This change is a small diagnostic improvement, not a security fix. When a user opens the built-in developer console in Electrum, future crash reports will have '-consoletaint' added to the app version string. This helps Electrum's support team spot bug reports from users who may have manually changed internal settings at runtime, so they don't chase false bugs. It does not prevent any attack or close a vulnerability.
No security action required. Treat as a normal support/debugging improvement.
Security signals we found
No vulnerability is patched
No exploit primitive is removed
Change only affects metadata in crash reports
Console still executes arbitrary Python code with no added restrictions
Evidence from the diff
The patch adds a global flag _tainted_by_console and a setter taint_reports_by_console_usage() in base_crash_reporter.py. The Qt console’s internal _exec_command() now calls that setter before running any command, and get_additional_info() appends ‘-consoletaint’ to the reported app_version if the flag is set. The public method exec_command was renamed to _exec_command to make clear it is internal. No input validation, sandboxing, or access control is introduced.
Changed components
electrum/base_crash_reporter.pyelectrum/gui/qt/console.pyInspect captured patch +15 / −4
diff --git a/electrum/base_crash_reporter.py b/electrum/base_crash_reporter.py
index 1720538..3689649 100644
--- a/electrum/base_crash_reporter.py
+++ b/electrum/base_crash_reporter.py
@@ -39,6 +39,12 @@ if TYPE_CHECKING:
from .network import ProxySettings
+_tainted_by_console = False
+def taint_reports_by_console_usage():
+ global _tainted_by_console
+ _tainted_by_console = True
+
+
class CrashReportResponse(NamedTuple):
status: Optional[str]
text: str
@@ -153,8 +159,11 @@ class BaseCrashReporter(Logger):
return sha256(str(_id))
def get_additional_info(self):
+ app_version = (get_git_version() or ELECTRUM_VERSION)
+ if _tainted_by_console:
+ app_version += "-consoletaint"
args = {
- "app_version": get_git_version() or ELECTRUM_VERSION,
+ "app_version": app_version,
"python_version": sys.version,
"os": describe_os_version(),
"wallet_type": "unknown",
diff --git a/electrum/gui/qt/console.py b/electrum/gui/qt/console.py
index 775b1bf..a6ce897 100644
--- a/electrum/gui/qt/console.py
+++ b/electrum/gui/qt/console.py
@@ -11,6 +11,7 @@ from PyQt6.QtCore import Qt
from electrum import util
from electrum.i18n import _
+from electrum.base_crash_reporter import taint_reports_by_console_usage
from .util import MONOSPACE_FONT, font_height
@@ -83,7 +84,7 @@ class Console(QtWidgets.QPlainTextEdit):
with open(filename) as f:
script = f.read()
- self.exec_command(script)
+ self._exec_command(script)
def updateNamespace(self, namespace):
self.namespace.update(namespace)
@@ -221,12 +222,13 @@ class Console(QtWidgets.QPlainTextEdit):
command = self.getConstruct(command)
if command:
- self.exec_command(command)
+ self._exec_command(command)
self.newPrompt('')
self.set_json(False)
- def exec_command(self, command):
+ def _exec_command(self, command):
tmp_stdout = sys.stdout
+ taint_reports_by_console_usage()
class StdoutProxy:
def __init__(self, write_func):
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.