improve thp pairing flow, and add passphrase session support
What the developer wrote
Authored by Craig Raw
improve thp pairing flow, and add passphrase session support
What changed, and why it matters
This commit improves the user interface for pairing a Trezor hardware wallet with Sparrow Wallet. It adds a numeric-only input filter for the pairing code, makes the text larger, and shows the device name in pairing messages. There is no clear security vulnerability in the changes.
No security action required. If reviewing the lark submodule update, obtain its diff to confirm no security-relevant changes were introduced there.
Security signals we found
UI-only change to hardware-wallet pairing flow
Input restricted to digits for pairing code
No cryptographic or authorization logic changed in visible diff
Evidence from the diff
The patch modifies the TrezorFxNoiseConfig inner class in Hwi.java. It introduces a deviceInfo field, sets it during confirmPairing() and pairingSuccessful(), and uses it in the pairing-code prompt header. It also adds a TextFormatter restricting the pairing code input to digits, increases the editor font size, and adjusts margins. The lark submodule reference changed, but no diff for it is provided. No cryptographic, authorization, or input-validation flaw is visible in the Java diff.
Changed components
src/main/java/com/sparrowwallet/sparrow/io/Hwi.javaTrezorFxNoiseConfig pairing UIInspect captured patch +18 / −4
diff --git a/src/main/java/com/sparrowwallet/sparrow/io/Hwi.java b/src/main/java/com/sparrowwallet/sparrow/io/Hwi.java
index baf426b..717ff40 100644
--- a/src/main/java/com/sparrowwallet/sparrow/io/Hwi.java
+++ b/src/main/java/com/sparrowwallet/sparrow/io/Hwi.java
@@ -20,8 +20,11 @@ import javafx.application.Platform;
import javafx.concurrent.ScheduledService;
import javafx.concurrent.Service;
import javafx.concurrent.Task;
+import javafx.geometry.Insets;
import javafx.scene.control.Alert;
import javafx.scene.control.ButtonType;
+import javafx.scene.control.TextFormatter;
+import javafx.scene.layout.HBox;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -546,6 +549,8 @@ public class Hwi {
}
private static final class TrezorFxNoiseConfig extends TrezorFileNoiseConfig {
+ private String deviceInfo;
+
public TrezorFxNoiseConfig() {
super(Path.of(Storage.getSparrowHome().getAbsolutePath(), LARK_HOME_DIR, TREZOR_FILENAME).toFile());
}
@@ -553,14 +558,22 @@ public class Hwi {
@Override
public String promptForPairingCode() {
CompletableFuture<String> future = new CompletableFuture<>();
-
Platform.runLater(() -> {
TextfieldDialog textfieldDialog = new TextfieldDialog();
textfieldDialog.initOwner(AppServices.getActiveWindow());
textfieldDialog.setTitle("Enter Pairing Code");
- textfieldDialog.setHeaderText("Enter the code shown on the device");
+ textfieldDialog.setHeaderText("Enter the code shown on the " + deviceInfo + ":");
textfieldDialog.getDialogPane().setPrefWidth(300);
textfieldDialog.getEditor().setOnAction(_ -> textfieldDialog.setResult(textfieldDialog.getEditor().getText()));
+ textfieldDialog.getEditor().setTextFormatter(new TextFormatter<>(change -> {
+ String newText = change.getControlNewText();
+ if(newText.matches("\\d*")) {
+ return change;
+ }
+ return null;
+ }));
+ textfieldDialog.getEditor().setStyle("-fx-font-size: 30px;");
+ HBox.setMargin(textfieldDialog.getEditor(), new Insets(0, 60, 0, 60));
textfieldDialog.getEditor().requestFocus();
textfieldDialog.showAndWait().ifPresentOrElse(future::complete, () -> future.complete(null));
});
@@ -578,8 +591,8 @@ public class Hwi {
@Override
public boolean confirmPairing(String deviceInfo) {
+ this.deviceInfo = deviceInfo;
CompletableFuture<ButtonType> future = new CompletableFuture<>();
-
Platform.runLater(() -> {
AppServices.showAlertDialog("Pairing Required", "Pair the " + deviceInfo + " with " + SparrowWallet.APP_NAME + "?",
Alert.AlertType.CONFIRMATION, ButtonType.YES, ButtonType.NO).ifPresentOrElse(future::complete, () -> future.complete(null));
@@ -613,6 +626,7 @@ public class Hwi {
@Override
public void pairingSuccessful(String deviceInfo) {
+ this.deviceInfo = deviceInfo;
Platform.runLater(() -> AppServices.showSuccessDialog("Pairing Successful", "The " + deviceInfo + " has been successfully paired."));
}
}
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.