fix(python): skip `EndSession` in case of invalidated THP channel
What the developer wrote
Authored by Roman Zeyde
fix(python): skip `EndSession` in case of invalidated THP channel
[no changelog]
What changed, and why it matters
This is a small fix in the Trezor Python command-line library. It stops the software from sending an 'EndSession' message when the secure communication channel (THP) has already been invalidated. Without the fix, the code might try to close a session on a broken or closed channel, which could cause an unnecessary error or warning. It does not appear to be a security vulnerability in the hardware wallet itself.
No urgent action required. Treat as a routine robustness improvement. Users of the Python library can update at their normal cadence. If a CVE or advisory is later published, reassess.
Security signals we found
Defensive check added to avoid sending EndSession on invalidated channel
No cryptographic, authentication, or firmware changes
No changelog entry suggests minor/internal fix
Evidence from the diff
The change adds a check session.client.is_invalidated before calling session.end() in the with_session decorator. The intent is to avoid sending EndSession when the THP (Trezor Host Protocol) channel has been invalidated. This is a defensive robustness fix in the Python client library, not a cryptographic or firmware-level security fix. The commit message and diff provide no evidence of an exploit, privilege escalation, or asset loss.
Changed components
python/src/trezorlib/cli/__init__.pyTrezor Python CLI client library session cleanup logicInspect captured patch +5 / −1
diff --git a/python/src/trezorlib/cli/__init__.py b/python/src/trezorlib/cli/__init__.py
index ce8060d1..2d332e50 100644
--- a/python/src/trezorlib/cli/__init__.py
+++ b/python/src/trezorlib/cli/__init__.py
@@ -360,7 +360,11 @@ def with_session(
return func(session, *args, **kwargs)
finally:
- if not is_resume_mandatory and not session.features.bootloader_mode:
+ if (
+ not is_resume_mandatory
+ and not session.features.bootloader_mode
+ and not session.client.is_invalidated
+ ):
session.end()
return function_with_session
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.