But he immediately fucked up when fabricating the "evidence" of the disappearing dev from Feb 2024: The coordinator string feature wasn't even added until June 2024 - https://github.com/WalletWasabi/WalletWasabi/pull/13190
$ git show --pretty=raw da5c4507
commit da5c4507e9f2149ca651d9b5db2844596442ab11
tree 7c54c9d9f9e017ad99624f49d149dbdad93da669
parent e0ed06bae08809f32746a36a132b600630b18cbe
author wd <noreply@email.com> 1708001726 +0000
committer Wiesław Šoltés <wieslawsoltes@users.noreply.github.com> 1708354759 +0100
fix opening browser on macos.
[..]
$ date -u --iso-8601=seconds -d @1708354759
2024-02-19T14:59:19+00:00
Doesn't mean it's malicious per se though: noreply@email.com is a dummy author email and the committer is anyway the last person to touch it. As it doesn't have a signature, there is no valid evidence in any way that anyone mentioned here did this in the first place, so whatevs. Bugs happen. Glad it is fixed.
For anyone triaging this: the risk is a classic 'unsafe URL string passed to a shell context' bug — the fix is to never use OS shell for URL opening at all, use the platform URI API with strict scheme allowlist (http/https only) and reject anything else before it reaches the desktop environment. Also worth verifying whether the 'Read More' link is user-controlled content (e.g. from a signed message or memo) vs wallet-generated — that determines if this is exploitable remotely or requires prior UI interaction.
Cool to see Wasabi makes news headlines for every previously fixed bug. It is old news though, and Ledger deserves the credit: https://github.com/WalletWasabi/WalletWasabi/pull/14412#discussion_r2947802589
Not sure why it got popular today, but was not aware of it until now.
It got popular because LaurentMT turned it into a hoax by claiming some anonymous dev introduced the bug and then scrubbed their account: https://x.com/Kruwed/status/2088301854522257453
But he immediately fucked up when fabricating the "evidence" of the disappearing dev from Feb 2024: The coordinator string feature wasn't even added until June 2024 - https://github.com/WalletWasabi/WalletWasabi/pull/13190
He's referring to
da5c4507.git log -L /OpenBrowserAsync/:WalletWasabi/Helpers/IoHelpers.csis your friend.
$ git show --pretty=raw da5c4507 commit da5c4507e9f2149ca651d9b5db2844596442ab11 tree 7c54c9d9f9e017ad99624f49d149dbdad93da669 parent e0ed06bae08809f32746a36a132b600630b18cbe author wd <noreply@email.com> 1708001726 +0000 committer Wiesław Šoltés <wieslawsoltes@users.noreply.github.com> 1708354759 +0100 fix opening browser on macos. [..] $ date -u --iso-8601=seconds -d @1708354759 2024-02-19T14:59:19+00:00Doesn't mean it's malicious per se though:
noreply@email.comis a dummy author email and the committer is anyway the last person to touch it. As it doesn't have a signature, there is no valid evidence in any way that anyone mentioned here did this in the first place, so whatevs. Bugs happen. Glad it is fixed.https://twiiit.com/Kruwed/status/2088301854522257453
fixed since 2.8.0?
correct
For anyone triaging this: the risk is a classic 'unsafe URL string passed to a shell context' bug — the fix is to never use OS shell for URL opening at all, use the platform URI API with strict scheme allowlist (http/https only) and reject anything else before it reaches the desktop environment. Also worth verifying whether the 'Read More' link is user-controlled content (e.g. from a signed message or memo) vs wallet-generated — that determines if this is exploitable remotely or requires prior UI interaction.