feat(core/delizia): enable external menus for `confirm_properties()`
What the developer wrote
Authored by Roman Zeyde
feat(core/delizia): enable external menus for `confirm_properties()`
[no changelog]
What changed, and why it matters
This commit changes a Trezor firmware UI function so that a previously ignored 'external menu' flag is now actually used. When the flag is set, the confirmation screen uses an externally supplied menu instead of the built-in one. The change is small and appears to be a feature enablement rather than a fix for an active security bug, but it touches user-confirmation flow code where mistakes could affect what options a user sees.
Review the callers that can now pass `external_menu: true` and verify that `ConfirmActionExtra::ExternalMenu` is constrained to trustworthy, validated menu content. Confirm that the external menu cannot be used to hide security-critical options (e.g., 'Cancel', 'Hold to confirm') or to spoof approval prompts. Treat this as a normal security-sensitive feature commit rather than an emergency vulnerability patch unless further evidence emerges.
Security signals we found
Parameter previously ignored (`_external_menu`) is now active
Affects confirmation-screen menu construction in hardware wallet firmware
Switches between internal and external menu source based on caller input
No changelog entry supplied
No explicit security context in commit message or diff
Evidence from the diff
In core/embed/rust/src/ui/layout_delizia/ui_firmware.rs, the confirm_properties() implementation for the Delizia layout previously accepted an external_menu: bool parameter but discarded it by binding it to _external_menu. The patch renames the binding to external_menu and branches on it: if true, it passes ConfirmActionExtra::ExternalMenu to flow::new_confirm_action_simple(); otherwise it keeps the existing ConfirmActionExtra::Menu(ConfirmActionMenuStrings::new()). This is a plumbing change that wires an existing parameter into the UI flow.
Changed components
Trezor firmware core UI layerDelizia layout implementation`confirm_properties()` confirmation flow`flow::new_confirm_action_simple()` menu handlingInspect captured patch +6 / −2
diff --git a/core/embed/rust/src/ui/layout_delizia/ui_firmware.rs b/core/embed/rust/src/ui/layout_delizia/ui_firmware.rs
index 92445797..b0e3eb77 100644
--- a/core/embed/rust/src/ui/layout_delizia/ui_firmware.rs
+++ b/core/embed/rust/src/ui/layout_delizia/ui_firmware.rs
@@ -444,13 +444,17 @@ impl FirmwareUI for UIDelizia {
items: Obj,
hold: bool,
_verb: Option<TString<'static>>,
- _external_menu: bool,
+ external_menu: bool,
) -> Result<impl LayoutMaybeTrace, Error> {
let paragraphs = PropsList::new(items)?;
let flow = flow::new_confirm_action_simple(
paragraphs.into_paragraphs(),
- ConfirmActionExtra::Menu(ConfirmActionMenuStrings::new()),
+ if external_menu {
+ ConfirmActionExtra::ExternalMenu
+ } else {
+ ConfirmActionExtra::Menu(ConfirmActionMenuStrings::new())
+ },
ConfirmActionStrings::new(title, subtitle, None, hold.then_some(title)),
ConfirmActionOptions::new().with_hold(hold),
)?;
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.