True binary QRs: Deal with binary encoded UR QR code (#798)
What the developer wrote
Authored by Odudex
True binary QRs: Deal with binary encoded UR QR code (#798)
What changed, and why it matters
This commit fixes a small bug in how Krux reads certain QR codes. Some QR codes carry raw binary data, and the code previously assumed the data would arrive as text. The fix converts binary data to text before passing it onward. This is a defensive correction that prevents a crash or misread when scanning a specific kind of QR code (binary-encoded Uniform Resource QR codes). There is no direct evidence in the commit that this is exploitable as a security attack.
Treat as a low-risk bugfix. Review whether other decoder paths (BBQR, plain text) also need similar bytes/str normalization, and verify that the default decode() encoding (UTF-8) matches the expected QR data encoding for UR payloads.
Security signals we found
Input-type normalization for decoder
Potential TypeError/misparse on binary QR payloads without the fix
No explicit security claim in commit message
Evidence from the diff
In src/krux/qr.py, inside QRPartParser.receive_part(), the code now decodes bytes to str before calling URDecoder.receive_part(). Previously, if a UR QR part arrived as bytes, the decoder would receive bytes instead of a string, likely causing a TypeError or incorrect parsing. The patch is a one-line normalization: data = data.decode() if isinstance(data, bytes) else data. This is a robustness fix for handling true-binary QR payloads in the UR decoder path.
Changed components
src/krux/qr.pyQRPartParser.receive_part()UR QR code decoding pathInspect captured patch +1 / −0
diff --git a/src/krux/qr.py b/src/krux/qr.py
index b37cb14..73d3b30 100644
--- a/src/krux/qr.py
+++ b/src/krux/qr.py
@@ -181,6 +181,7 @@ class QRPartParser:
from ur.ur_decoder import URDecoder
self.decoder = URDecoder()
+ data = data.decode() if isinstance(data, bytes) else data
self.decoder.receive_part(data)
elif self.format == FORMAT_BBQR:
from .bbqr import parse_bbqr
Why this scored 32/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.