qt/qml: labels to require opt-in to rich text by SomberNight · Pull Request #10972 · spesmilo/electrum

SomberNight · 2026-09-14T21:21:33Z

I want ~all text in the GUIs to be plaintext by default. Every text field that expects/wants to render rich text must explicitly opt-in to that behaviour.

QLabel in QtWidgets, and Label in QML, default their textFormat to AutoText, which means they allow and render rich text as needed.
It is not just labels though: QML also has at least TextArea and TextEdit, and QtWidgets has QMessageBox.

The designers of Qt chose convenience-by-default, but I want security (or rather, sanity)-by-default.

(I don't know whether this PR is the best way to implement this though, and I don't mind if we come up with something else instead, all I care about is the end-result described in the first paragraph.)

For the Qt Widgets GUI, this uses an EventFilter-based approach, that listens for "Polish" QEvents.
For the QML GUI, only Android is covered: during the Android build, we patch Qt to change the default from AutoText to PlainText. This leaves the Linux desktop dev environment and potential Linux phone users uncovered.
- I have an earlier approach in branch "202609_qt_label_plaintext_by_default_4", which instead was shadowing the built-in Label/TextArea with our custom Label type. That would work on all platforms but it is fragile.

Note: there is a proposal on the Qt mailing list to change the default to PlainText, in Qt7, which has some traction (?)

Alwoch · 2026-09-17T14:58:03Z

The Timelock recovery plugin now renders HTML as text.
Here's a before:

pic1

And here's the after:

pic2

Removing the markup from plugins/timelock_recovery/manifest.json should resolve this.

-  "description": "<br/>This plug-in allows you to create Timelock Recovery Plans for your wallet. See: <a href='https://timelockrecovery.com'>timelockrecovery.com</a>",
+  "description": "This plug-in allows you to create Timelock Recovery Plans for your wallet. See: https://timelockrecovery.com",

SomberNight · 2026-09-17T16:05:54Z

The Timelock recovery plugin now renders HTML as text.

Thanks. Fixed in f26429e

Alwoch · 2026-09-17T16:20:25Z

I was thinking of a workaround the long tooltips and I think a utility function that wraps the the text before setting the tooltip could do? something like:

import textwrap

def wrap_tooltip_text(text: str, *, width: int = 60) -> str:
    return "\n".join(
        textwrap.fill(line, width=width, break_on_hyphens=False)
        for line in text.split("\n")
    )

and then here:

cb.setToolTip(wrap_tooltip_text(long_desc))

and the same in QMenuWithConfig.addConfig (tooltip = wrap_tooltip_text(long_desc)).

Here's a before:

pic1

and after:

pic2

SomberNight · 2026-09-17T17:23:18Z

I was thinking of a workaround the long tooltips and I think a utility function that wraps the the text before setting the tooltip could do? something like: [...]

Oh cool! Thanks. I did not know about that module in the standard library :)
Added in 51b47ae. The default params look fine.

ecdsa · 2026-09-21T11:05:21Z

  "name": "trustedcoin",
  "fullname": "Two Factor Authentication",
-  "description": "This plugin adds two-factor authentication to your wallet.<br/>For more information, visit <a href=\"https://api.trustedcoin.com/#/electrum-help\">https://api.trustedcoin.com/#/electrum-help</a>",
+  "description": "This plugin adds two-factor authentication to your wallet.\nFor more information, visit https://api.trustedcoin.com/#/electrum-help",


we could as well add an explicit "url" section to the manifest.json of plugins.

Sure, we can do that. Would rather not do it in this PR though.

Security-by-default, instead of convenience: require programmer to opt-in to RichText. This patches Qt only for the Android build, and adds a runtime regression check. We mainly use the QML GUI for Android. However this leaves the Linux desktop dev environment and potential Linux phone users uncovered :/

You have to opt-in to rich text if you want it for your label! Upstream chose convenience-by-default for their GUI framework. Shame. :) ----- earlier, less satisfactory attempt: ``` def eventFilter(self, obj: QObject, event: QEvent) -> bool: if not isinstance(event, QtCore.QChildEvent): return False # - ChildAdded event: already constructed QWidget gets parented # - note: does *not* fire if parent gets set at construction time, e.g. Label("", parent=self) # - ChildPolished event: # - see https://doc.qt.io/qt-6/qstyle.html#polish : # > This function is called for every widget at some point after it has been fully created # > but just before it is shown for the very first time. if event.type() not in (QEvent.Type.ChildAdded, QEvent.Type.ChildPolished): return False child = event.child() if not isinstance(child, QLabel): return False if child.textFormat() != Qt.TextFormat.AutoText: # non-default textFormat => we leave it alone return False child.setTextFormat(Qt.TextFormat.PlainText) return False ```

this special-case QApplication is not covered by InjectNoRichTextEventFilter

- InjectNoRichTextEventFilter is changing AutoText to PlainText, and that also affects the internal QLabel inside the message box

llm output: > Linux with a screen reader running. Here the accessibility bridge queries the label’s text from inside > setText(), and Qt parses the HTML at that moment. This also affects custom_message_box(rich_text=False), > which passes the text to the QMessageBox constructor before switching it to PlainText.

tooltips use QLabel internally, so due to InjectNoRichTextEventFilter, their textFormat is no longer AutoText, but is now PlainText instead. note: messages.to_rtf() was specifically introduced for usage with tooltips [0], I guess to nudge Qt to break longer lines more often (so that tooltips widths are smaller). Tooltips being forced to PlainText breaks that. I also cannot see an easy way to opt-in the tooltip of e.g. a QCheckBox to RichText. Instead, now we use the "textwrap" module from the stdlib to manually word-wrap the strings. [0]: spesmilo@345c2b4 Co-authored-by: Alwoch <salwoch@gmail.com>

- rich text can contain embedded base64-encoded images - qt docs say [0] it is not safe to parse untrusted input as an image [0]: https://doc.qt.io/qt-6/qtimageformats-index.html : > Security Considerations: > Since these file formats are more rarely used, the codecs may be > less thoroughly debugged against potential security holes. As always, > care should be taken when creating applications that may be used > to decode uncontrolled data files.

SomberNight · 2026-09-25T17:58:45Z

Well I think this is as good as I can get it, and ready for merge.

SomberNight added Qt ✨ gui-qml gui-qt-desktop labels Sep 14, 2026

SomberNight force-pushed the 202609_qt_label_plaintext_by_default branch from b180bd5 to 0c88fea Compare September 14, 2026 21:55

SomberNight marked this pull request as draft September 14, 2026 23:56

SomberNight force-pushed the 202609_qt_label_plaintext_by_default branch 3 times, most recently from 1e37407 to d94ef5c Compare September 15, 2026 15:14

qt: (trivial) don't rely on implicit 1->True conversion

4ce16d9

SomberNight force-pushed the 202609_qt_label_plaintext_by_default branch from d94ef5c to 28db4ce Compare September 15, 2026 17:51

SomberNight marked this pull request as ready for review September 16, 2026 14:51

SomberNight force-pushed the 202609_qt_label_plaintext_by_default branch from f26429e to 3067352 Compare September 17, 2026 17:21

SomberNight commented Sep 17, 2026

View reviewed changes

Comment thread electrum/gui/qt/plugins_dialog.py Outdated

SomberNight commented Sep 18, 2026

View reviewed changes

Comment thread electrum/gui/qt/__init__.py

SomberNight force-pushed the 202609_qt_label_plaintext_by_default branch from 3067352 to 1d5de54 Compare September 18, 2026 17:06

ecdsa reviewed Sep 21, 2026

View reviewed changes

This comment was marked as outdated.

Sign in to view

SomberNight added this to the 4.9.0 milestone Sep 23, 2026

SomberNight commented Sep 24, 2026

View reviewed changes

Comment thread electrum/gui/qml/components/controls/AddressDelegate.qml Outdated

SomberNight force-pushed the 202609_qt_label_plaintext_by_default branch from 13c96a1 to 5ad7060 Compare September 25, 2026 14:09

SomberNight marked this pull request as draft September 25, 2026 14:09

SomberNight force-pushed the 202609_qt_label_plaintext_by_default branch from 46e1f4d to 62c32c2 Compare September 25, 2026 14:46

SomberNight added 2 commits September 25, 2026 17:01

qml: explicitly opt-in to RichText where used

841529b

SomberNight force-pushed the 202609_qt_label_plaintext_by_default branch from 62c32c2 to c2a0a03 Compare September 25, 2026 17:20

SomberNight and others added 8 commits September 25, 2026 17:54

qt: standalone_exception_dialog: force plaintext

5f4a054

this special-case QApplication is not covered by InjectNoRichTextEventFilter

qt: explicitly opt-in to RichText where used

c83992f

qt: util.custom_message_box: use explicit RichText instead of AutoText

8c1591b

- InjectNoRichTextEventFilter is changing AutoText to PlainText, and that also affects the internal QLabel inside the message box

qt: util.HelpMixin: change "rich_text" default to False

47e25e7

qt: PasswordDialog: require opt-in to rich-text

5181742

SomberNight force-pushed the 202609_qt_label_plaintext_by_default branch from c2a0a03 to e258401 Compare September 25, 2026 17:55

SomberNight marked this pull request as ready for review September 25, 2026 17:55

ecdsa merged commit 76dbf2b into spesmilo:master Sep 26, 2026
11 checks passed

Navigation Menu

qt/qml: labels to require opt-in to rich text - #10972

qt/qml: labels to require opt-in to rich text#10972
ecdsa merged 12 commits into
spesmilo:masterfrom
SomberNight:202609_qt_label_plaintext_by_default

SomberNight commented Sep 14, 2026 •

edited

Loading

Uh oh!

Alwoch commented Sep 17, 2026 •

edited by SomberNight

Loading

Uh oh!

SomberNight commented Sep 17, 2026

Uh oh!

Alwoch commented Sep 17, 2026 •

edited by SomberNight

Loading

Uh oh!

SomberNight commented Sep 17, 2026

Uh oh!

Uh oh!

Uh oh!

ecdsa Sep 21, 2026 •

edited

Loading

Uh oh!

SomberNight Sep 21, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

SomberNight commented Sep 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

SomberNight commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Alwoch commented Sep 17, 2026 • edited by SomberNight Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SomberNight commented Sep 17, 2026

Uh oh!

Alwoch commented Sep 17, 2026 • edited by SomberNight Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SomberNight commented Sep 17, 2026

Uh oh!

Uh oh!

Uh oh!

ecdsa Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SomberNight Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

SomberNight commented Sep 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

SomberNight commented Sep 14, 2026 •

edited

Loading

Alwoch commented Sep 17, 2026 •

edited by SomberNight

Loading

Alwoch commented Sep 17, 2026 •

edited by SomberNight

Loading

ecdsa Sep 21, 2026 •

edited

Loading