fix(python): bridge debuglink session id
What the developer wrote
Authored by Szymon Lesisz
fix(python): bridge debuglink session id
[no changelog]
What changed, and why it matters
This is a small bug fix in Trezor's Python library. When using a special developer/debug connection to the Trezor Bridge, the code was accidentally using the normal user session ID instead of the dedicated debug session ID. That could cause debug commands to interfere with or be sent to the wrong session. It is a correctness fix rather than a clear-cut security vulnerability, but mixing debug and normal sessions could create unexpected behavior for developers.
Treat as a low-risk bug fix. Review whether the session confusion could have caused any unintended side effects in debug workflows, and consider adding a changelog entry to document the corrected behavior.
Security signals we found
Session identifier confusion between normal and debug contexts
Debug transport could operate on the wrong session
No changelog entry provided for a behavior-affecting fix
Evidence from the diff
In python/src/trezorlib/transport/bridge.py, BridgeTransport.init sets self.session from device[‘session’] unconditionally, then stores self.debug. The patch adds a check so that when debug=True, self.session is taken from device[‘debugSession’] instead. This ensures debuglink operations use the bridge’s debug session rather than the regular session. The change is two lines and marked [no changelog].
Changed components
python/src/trezorlib/transport/bridge.pyBridgeTransport debuglink initializationInspect captured patch +2 / −0
diff --git a/python/src/trezorlib/transport/bridge.py b/python/src/trezorlib/transport/bridge.py
index 7bdc6ab81..211de3118 100644
--- a/python/src/trezorlib/transport/bridge.py
+++ b/python/src/trezorlib/transport/bridge.py
@@ -132,6 +132,8 @@ class BridgeTransport(Transport):
raise TransportException("Debugging not supported on legacy Bridge")
self.device = device
self.session: str | None = device["session"]
+ if debug:
+ self.session = device["debugSession"]
self.debug = debug
self.legacy = legacy
Why this scored 23/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.