refactor(core): scope menu details' layout
What changed, and why it matters
This is a small internal code cleanup in the Trezor firmware's user interface code. It renames a variable and ensures a temporary layout object is properly cleaned up after use. There is no indication this fixes a security vulnerability or introduces one.
No security action required. Treat as a normal code-quality refactor.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit refactors the Details class in core/src/trezor/ui/layouts/menu.py. It renames the factory callable to _interact and wraps the layout creation/interaction in a context manager (with layout_factory() as obj:) so the layout object is de-allocated after interact() returns. This is a memory-management and naming refactor with no apparent security relevance.
Changed components
core/src/trezor/ui/layouts/menu.pyInspect captured patch +10 / −8
diff --git a/core/src/trezor/ui/layouts/menu.py b/core/src/trezor/ui/layouts/menu.py
index f26065b9..15ff8900 100644
--- a/core/src/trezor/ui/layouts/menu.py
+++ b/core/src/trezor/ui/layouts/menu.py
@@ -40,18 +40,20 @@ class Menu:
class Details:
- def __init__(self, name: str, factory: Callable[[], Awaitable[T]]) -> None:
+ def __init__(self, name: str, interact: Callable[[], Awaitable[T]]) -> None:
self.name = name
- self.factory = factory
+ self._interact = interact
@classmethod
def from_layout(
cls, name: str, layout_factory: Callable[[], trezorui_api.LayoutObj[T]]
) -> Self:
- return cls(
- name,
- lambda: interact(layout_factory(), br_name=None, raise_on_cancel=None),
- )
+ async def _interact() -> T:
+ with layout_factory() as obj:
+ # details' layout is de-allocated after interact() returns.
+ return await interact(obj, br_name=None, raise_on_cancel=None)
+
+ return cls(name, _interact)
class Cancel(Details):
@@ -79,7 +81,7 @@ async def show_menu(
if choice is trezorui_api.CANCELLED:
if menu.cancel:
- result = await menu.cancel.factory()
+ result = await menu.cancel._interact()
assert result in (trezorui_api.CONFIRMED, trezorui_api.CANCELLED)
if result is trezorui_api.CONFIRMED:
# cancellation is confirmed - raise an exception
@@ -94,7 +96,7 @@ async def show_menu(
else:
assert isinstance(menu, Details)
# Details' layout is created on-demand (saving memory)
- await menu.factory() # the result is ignored
+ await menu._interact() # the result is ignored
# go one level up, or exit the menu
if menu_path:
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.