catch any parse failure when opening pasted or server-fetched transactions
What the developer wrote
Authored by Craig Raw
catch any parse failure when opening pasted or server-fetched transactions
What changed, and why it matters
This commit hardens Sparrow Wallet so that unexpected failures while reading pasted transactions or transactions fetched from Electrum servers are caught and handled gracefully, instead of crashing the application. It also updates the 'drongo' subproject, which likely contains related parsing code. The change is defensive and improves robustness, but the commit message does not frame it as a security fix.
Review the drongo submodule diff for the bumped commit to determine whether it contains additional parsing or security fixes. Treat this as a robustness improvement unless further context shows it addresses a disclosed vulnerability.
Security signals we found
Broad exception handling around transaction/PSBT parsing
Prevents crashes from malformed pasted or server-fetched transaction data
Subproject bump (drongo) may include related parsing fixes, but diff content is not supplied
No explicit security framing in commit title or message
Evidence from the diff
The patch broadens exception handling in two places: (1) AppController.openTransactionFromText now catches generic Exception after existing specific catches, logging and showing a user-friendly error dialog; (2) ElectrumServer.getTransactions and getUtxos replace a narrow ProtocolException catch with a generic Exception catch when parsing hex transactions, logging the full stack trace and continuing. The drongo submodule is bumped from 350dd874 to b8a9ff19, suggesting related parsing changes in the dependency. No explicit security relevance, CVE, or researcher attribution is present in the supplied materials.
Changed components
src/main/java/com/sparrowwallet/sparrow/AppController.javasrc/main/java/com/sparrowwallet/sparrow/net/ElectrumServer.javadrongo subprojectInspect captured patch +9 / −7
### drongo
@@ -1 +1 @@
-Subproject commit 350dd874da946aadc91188c8a062c5911046d8df
+Subproject commit b8a9ff19000124d259b7172d9de80a6461baf721
### src/main/java/com/sparrowwallet/sparrow/AppController.java
@@ -688,6 +688,9 @@ public void openTransactionFromText(ActionEvent event) {
showErrorDialog("Invalid transaction", e.getMessage());
} catch(ParseException e) {
showErrorDialog("Could not recognise input", e.getMessage());
+ } catch(Exception e) {
+ log.error("Could not parse pasted transaction or PSBT", e);
+ showErrorDialog("Could not recognise input", "The pasted text could not be parsed as a transaction or PSBT.");
}
}
}
### src/main/java/com/sparrowwallet/sparrow/net/ElectrumServer.java
@@ -871,13 +871,12 @@ public Map<Sha256Hash, BlockTransaction> getTransactions(Wallet wallet, Map<Bloc
continue;
}
- byte[] rawtx = Utils.hexToBytes(strRawTx);
Transaction transaction;
try {
- transaction = new Transaction(rawtx);
- } catch(ProtocolException e) {
- log.error("Could not parse tx: " + strRawTx);
+ transaction = new Transaction(Utils.hexToBytes(strRawTx));
+ } catch(Exception e) {
+ log.error("Could not parse tx: " + strRawTx, e);
continue;
}
@@ -1347,8 +1346,8 @@ public List<TransactionOutput> getUtxos(Address address) throws ServerException
try {
transaction = new Transaction(Utils.hexToBytes(strRawTx));
- } catch(ProtocolException e) {
- log.error("Could not parse tx: " + strRawTx);
+ } catch(Exception e) {
+ log.error("Could not parse tx: " + strRawTx, e);
continue;
}
Why this scored 34/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.