chore(core): don't log THP cache entries by default
What the developer wrote
Authored by Roman Zeyde
chore(core): don't log THP cache entries by default
[no changelog]
What changed, and why it matters
This commit turns off routine debug logging for a cache that stores information about paired Bluetooth-like hosts in Trezor hardware wallets. The change prevents potentially sensitive pairing details from being written to debug logs by default, but the data was already only logged in special debug builds and is not exposed in normal production firmware.
No urgent action required. Treat as a minor privacy hardening change. If maintaining a fork, ensure debug builds intended for production do not enable `_TRACE` or `__debug__`.
Security signals we found
Debug logging of pairing cache entries disabled by default
Potential information disclosure via logs containing paired host names, app names, and MAC addresses
No functional code change; only logging behavior gated by new compile-time flag
Evidence from the diff
The patch adds a new compile-time constant _TRACE = const(False) and gates existing log.debug(...) calls in core/src/trezor/wire/thp/paired_cache.py behind __debug__ and _TRACE. Previously, these protobuf cache dumps and host/app names were logged whenever __debug__ was true. The change reduces the risk of sensitive THP (Trezor Host Protocol) pairing metadata appearing in debug output, but it is a hardening/privacy improvement rather than a fix for an exploitable vulnerability.
Changed components
core/src/trezor/wire/thp/paired_cache.pyInspect captured patch +5 / −4
diff --git a/core/src/trezor/wire/thp/paired_cache.py b/core/src/trezor/wire/thp/paired_cache.py
index 2088f6c8..1cc5de1f 100644
--- a/core/src/trezor/wire/thp/paired_cache.py
+++ b/core/src/trezor/wire/thp/paired_cache.py
@@ -10,6 +10,7 @@ if TYPE_CHECKING:
from buffer_types import AnyBytes
_ENABLE_EXPERIMENTAL = const(False)
+_TRACE = const(False)
def load() -> list[ThpPairedCacheEntry]:
@@ -21,7 +22,7 @@ def load() -> list[ThpPairedCacheEntry]:
return [] # an empty cache
cache = decode(blob, ThpPairedCache, _ENABLE_EXPERIMENTAL)
- if __debug__:
+ if __debug__ and _TRACE:
log.debug(__name__, "loaded THP cache:\n%s", utils.dump_protobuf(cache))
return cache.entries
@@ -41,7 +42,7 @@ def store(entries: list[ThpPairedCacheEntry], _bonds: set[bytes] | None = None)
entries = [e for e in entries if e.mac_addr in _bonds]
cache = ThpPairedCache(entries=entries)
- if __debug__:
+ if __debug__ and _TRACE:
log.debug(__name__, "storing THP cache:\n%s", utils.dump_protobuf(cache))
set_thp_paired_names(dump_message_buffer(cache))
@@ -49,7 +50,7 @@ def store(entries: list[ThpPairedCacheEntry], _bonds: set[bytes] | None = None)
def cache_host_info(mac_addr: AnyBytes | None, host_name: str, app_name: str) -> None:
if mac_addr is None:
- if __debug__:
+ if __debug__ and _TRACE:
log.debug(__name__, "no MAC address: host=%s app=%s", host_name, app_name)
return
@@ -59,7 +60,7 @@ def cache_host_info(mac_addr: AnyBytes | None, host_name: str, app_name: str) ->
entries = load()
for e in entries:
if mac_addr == e.mac_addr:
- if __debug__:
+ if __debug__ and _TRACE:
log.debug(
__name__,
"found cached MAC %s:\n%s",
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.