refactor(python/trezorctl): respect prompt_passphrase when creating a new session
What the developer wrote
Authored by matejcik
refactor(python/trezorctl): respect prompt_passphrase when creating a new session
the previous sequence of changes removed a short circuit path for "not
prompt_passphrase", this commit restores the correct behavior
What changed, and why it matters
This commit fixes a regression in the Trezor command-line tool (trezorctl). A recent earlier change accidentally removed a shortcut that skips asking the user for their passphrase when the caller explicitly says it is not needed. Because of that regression, trezorctl could prompt for or require a passphrase even in situations where it should not, such as when running commands that do not need a wallet. The patch restores the intended behavior by adding a `prompt_passphrase` flag and returning an empty passphrase when it is false.
Treat as a routine bug-fix refactor with minor UX/security relevance. Review the prior refactor that removed the short-circuit to ensure no other call sites are affected. No urgent security response is indicated from the diff alone, but users of trezorctl should update to avoid unexpected passphrase prompts.
Security signals we found
Behavioral regression in authentication flow
Passphrase prompt bypass restored for non-wallet operations
No cryptographic changes or buffer/memory safety issues visible
No explicit security disclosure or CVE referenced in commit
Evidence from the diff
The change modifies python/src/trezorlib/cli/__init__.py. It adds a prompt_passphrase: bool = True parameter to _passphrase_source_resolved() and get_new_session(), and threads the same parameter through get_session(). When prompt_passphrase is False, _passphrase_source_resolved() now returns PassphraseSource.EMPTY immediately, causing the session to be opened with PassphraseSetting.STANDARD_WALLET instead of prompting the user or using device-based passphrase entry. This restores a previously existing short-circuit that was lost in a prior refactor.
Changed components
python/src/trezorlib/cli/__init__.pyTrezorConnection class_passphrase_source_resolved methodget_new_session methodtrezorctl CLI session allocationInspect captured patch +16 / −4
diff --git a/python/src/trezorlib/cli/__init__.py b/python/src/trezorlib/cli/__init__.py
index c73e179d..e26667b1 100644
--- a/python/src/trezorlib/cli/__init__.py
+++ b/python/src/trezorlib/cli/__init__.py
@@ -298,17 +298,24 @@ class TrezorConnection:
self._features = None
self._version = None
- def _passphrase_source_resolved(self) -> PassphraseSource:
+ def _passphrase_source_resolved(
+ self, prompt_passphrase: bool = True
+ ) -> PassphraseSource:
"""Resolve PassphraseSource.AUTO to a concrete PassphraseSource.
Assumes that `self.features` is already populated.
Returns:
+ * `PassphraseSource.EMPTY` if `prompt_passphrase` is False, indicating that
+ the caller does not ask for passphrase entry.
* `self.passphrase_source` if it is not `PassphraseSource.AUTO`
* `PassphraseSource.EMPTY` if passphrase protection is disabled
* `PassphraseSource.DEVICE` if passphrase entry is supported
* `PassphraseSource.PROMPT` otherwise
"""
+ if not prompt_passphrase:
+ return PassphraseSource.EMPTY
+
if (
not self.features.passphrase_protection
and not self.passphrase_source.ok_if_disabled()
@@ -353,10 +360,15 @@ class TrezorConnection:
raise
# nothing to resume, allocate a new session
- return self.get_new_session(derive_cardano=derive_cardano)
+ return self.get_new_session(
+ prompt_passphrase=prompt_passphrase, derive_cardano=derive_cardano
+ )
def get_new_session(
- self, derive_cardano: bool = False, randomize_id: bool = False
+ self,
+ prompt_passphrase: bool = True,
+ derive_cardano: bool = False,
+ randomize_id: bool = False,
) -> Session:
"""Allocate a new session.
@@ -377,7 +389,7 @@ class TrezorConnection:
random_value = random.randint(128, 255)
client._session_id_counter = random_value - 1
- passphrase_source = self._passphrase_source_resolved()
+ passphrase_source = self._passphrase_source_resolved(prompt_passphrase)
if passphrase_source == PassphraseSource.EMPTY:
return client.get_session(
passphrase=PassphraseSetting.STANDARD_WALLET,
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.