fix(core): add missing `if __debug__` before logging exceptions
What the developer wrote
Authored by Roman Zeyde
fix(core): add missing `if __debug__` before logging exceptions
[no changelog]
What changed, and why it matters
This commit wraps two debug-only exception log statements with an `if __debug__:` guard. In Python, `__debug__` is true unless the interpreter is run with the `-O` (optimize) flag. The change prevents exception details from being logged in optimized/production builds. The patch is defensive and reduces information leakage, but the actual security impact is minor because the logged data is not shown to untrusted parties by default and the exceptions themselves are already being caught and suppressed.
No urgent action required. Treat as routine hardening. If maintaining a fork, ensure similar debug-only logging patterns are followed elsewhere in the codebase to avoid unintended information leakage in production firmware.
Security signals we found
Information disclosure reduction: exception details no longer logged in non-debug builds
Defensive hardening: debug logging gated by `__debug__`
No functional behavior change in production code paths
Evidence from the diff
The diff adds if __debug__: guards around log.exception(__name__, e) calls in core/src/ble.py and core/src/trezor/ui/__init__.py. These calls were previously unconditional, meaning exception details could be logged even in optimized firmware builds. The change ensures exception logging only occurs in debug builds. This is a hardening patch rather than a fix for an exploitable vulnerability.
Changed components
core/src/ble.pycore/src/trezor/ui/__init__.pyInspect captured patch +4 / −2
diff --git a/core/src/ble.py b/core/src/ble.py
index cd493da19..c2f0bf4d8 100644
--- a/core/src/ble.py
+++ b/core/src/ble.py
@@ -23,4 +23,5 @@ try:
if ble.peer_count() > 0:
ble.start_advertising(True, storage.device.get_label())
except Exception as e:
- log.exception(__name__, e)
+ if __debug__:
+ log.exception(__name__, e)
diff --git a/core/src/trezor/ui/__init__.py b/core/src/trezor/ui/__init__.py
index 83dd2fbfd..4eca89551 100644
--- a/core/src/trezor/ui/__init__.py
+++ b/core/src/trezor/ui/__init__.py
@@ -280,7 +280,8 @@ class Layout(Generic[T]):
self.button_request_box.put(None, replace=True)
await is_done
except Exception as e:
- log.exception(__name__, e)
+ if __debug__:
+ log.exception(__name__, e)
return result
finally:
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.