Make the unverified oversize-preview fallback a user setting

An NFT image too large to inline cannot be hash-verified without
unbounded buffering, and the previous behavior fell back to loading it
directly from its source URL in confirmation dialogs. Since the
response's size and type claims are attacker-controlled, that fallback
could be triggered deliberately to place unverified content in a
transaction confirmation dialog.

- The fallback is now opt-in via a new 'Show unverified previews'
  switch in Settings > NFT (off by default): disabled, oversized
  images simply get no preview.
- The preference is stored as nftAllowUnverifiedPreviews via the
  existing prefs.yaml round-trip, so the main process reads the same
  value the renderer persists (electron/utils/allowUnverifiedNftPreviews,
  failing closed if the store is unreadable).
- nftGetImageDataUrl consults the policy only on the
  MaxSizeExceededError path; verified data-URL previews are unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LdfCqRSBWwMpCDh1SdE24e

Author: jlobue10

packages/gui/src/components/settings/SettingsNFT.tsx

@@ -14,6 +14,7 @@ import { Trans } from '@lingui/macro';
 import { Grid, Button, Switch, FormControlLabel, Typography } from '@mui/material';
 import React from 'react';
 
+import useAllowUnverifiedNFTPreviews from '../../hooks/useAllowUnverifiedNFTPreviews';
 import useCache from '../../hooks/useCache';
 import useHideObjectionableContent from '../../hooks/useHideObjectionableContent';
 import useNFTImageFittingMode from '../../hooks/useNFTImageFittingMode';
@@ -40,6 +41,7 @@ export default function SettingsGeneral() {
   const { cacheSize, clearCache, cacheDirectory, setCacheDirectory } = useCache();
   const [nftImageFittingMode, setNFTImageFittingMode] = useNFTImageFittingMode();
   const [nftVideoLoop, setNFTVideoLoop] = useNFTVideoLoopGlobal();
+  const [allowUnverifiedPreviews, setAllowUnverifiedPreviews] = useAllowUnverifiedNFTPreviews();
   // const [, setCacheFolder] = usePrefs('cacheFolder', '');
   const openDialog = useOpenDialog();
 
@@ -51,6 +53,10 @@ export default function SettingsGeneral() {
     setNFTVideoLoop(event.target.checked);
   }
 
+  function handleChangeAllowUnverifiedPreviews(event: React.ChangeEvent<HTMLInputElement>) {
+    setAllowUnverifiedPreviews(event.target.checked);
+  }
+
   async function clearNFTCache() {
     openDialog(
       <ConfirmDialog
@@ -144,6 +150,28 @@ export default function SettingsGeneral() {
         </Grid>
       </Grid>
 
+      <Grid container>
+        <Grid item style={{ width: '400px' }}>
+          <SettingsTitle>
+            <Trans>Show unverified previews</Trans>
+          </SettingsTitle>
+        </Grid>
+        <Grid item container xs justifyContent="flex-end" marginTop="-6px">
+          <FormControlLabel
+            control={<Switch checked={allowUnverifiedPreviews} onChange={handleChangeAllowUnverifiedPreviews} />}
+          />
+        </Grid>
+        <Grid item style={{ width: '400px' }}>
+          <SettingsText>
+            <Trans>
+              When an NFT image is too large to verify against its on-chain hash, load the transaction confirmation
+              preview directly from its source URL without verification. When disabled, no preview is shown for these
+              NFTs.
+            </Trans>
+          </SettingsText>
+        </Grid>
+      </Grid>
+
       <Grid item style={{ maxWidth: '400px' }}>
         <Flex flexDirection="column" gap={1}>
           <SettingsSection>

packages/gui/src/electron/api/nftGetMetadata.test.ts

@@ -11,6 +11,13 @@ jest.mock('../utils/fetchBuffer', () => ({
     jest.requireActual<typeof import('../utils/fetchBuffer')>('../utils/fetchBuffer').MaxSizeExceededError,
 }));
 
+const mockAllowUnverifiedNftPreviews = jest.fn<boolean, []>();
+
+jest.mock('../utils/allowUnverifiedNftPreviews', () => ({
+  __esModule: true,
+  default: mockAllowUnverifiedNftPreviews,
+}));
+
 const { MaxSizeExceededError } = jest.requireActual<typeof import('../utils/fetchBuffer')>('../utils/fetchBuffer');
 
 const { nftGetImageDataUrl, nftGetMetadata } =
@@ -59,6 +66,8 @@ describe('nftGetMetadata', () => {
 describe('nftGetImageDataUrl', () => {
   beforeEach(() => {
     mockFetchBuffer.mockReset();
+    mockAllowUnverifiedNftPreviews.mockReset();
+    mockAllowUnverifiedNftPreviews.mockReturnValue(false);
   });
 
   it('returns an immutable data URL for a verified image response', async () => {
@@ -92,7 +101,18 @@ describe('nftGetImageDataUrl', () => {
     expect(mockFetchBuffer).not.toHaveBeenCalled();
   });
 
-  it('falls back to the direct URL when an image response exceeds the size cap', async () => {
+  it('omits the preview for an oversized image response by default', async () => {
+    mockFetchBuffer.mockRejectedValue(
+      new MaxSizeExceededError({
+        'content-type': 'image/gif',
+      }),
+    );
+
+    await expect(nftGetImageDataUrl('https://example.com/large.gif', '00')).resolves.toBeUndefined();
+  });
+
+  it('falls back to the direct URL for an oversized image when unverified previews are enabled', async () => {
+    mockAllowUnverifiedNftPreviews.mockReturnValue(true);
     mockFetchBuffer.mockRejectedValue(
       new MaxSizeExceededError({
         'content-type': 'image/gif',
@@ -104,7 +124,8 @@ describe('nftGetImageDataUrl', () => {
     );
   });
 
-  it('rejects an oversized response that is not an image', async () => {
+  it('rejects an oversized response that is not an image even when unverified previews are enabled', async () => {
+    mockAllowUnverifiedNftPreviews.mockReturnValue(true);
     mockFetchBuffer.mockRejectedValue(
       new MaxSizeExceededError({
         'content-type': 'video/mp4',

packages/gui/src/electron/api/nftGetMetadata.ts

@@ -2,6 +2,7 @@ import crypto from 'node:crypto';
 
 import type Headers from '../../@types/Headers';
 import compareChecksums from '../../util/compareChecksums';
+import allowUnverifiedNftPreviews from '../utils/allowUnverifiedNftPreviews';
 import fetchBuffer, { MaxSizeExceededError } from '../utils/fetchBuffer';
 
 const METADATA_TIMEOUT = 10_000;
@@ -97,9 +98,12 @@ export async function nftGetImageDataUrl(
     return `data:${contentType};base64,${data.toString('base64')}`;
   } catch (error) {
     // An image too large to inline cannot be hash-verified without unbounded
-    // buffering. Fall back to the direct URL — the dialog CSP still allows
-    // https: images, matching the pre-verification behavior for these files.
-    if (error instanceof MaxSizeExceededError && getImageContentType(error.headers)) {
+    // buffering. When the user has opted in, fall back to the direct URL — the
+    // dialog CSP still allows https: images, matching the pre-verification
+    // behavior for these files. Off by default: the response's size and type
+    // claims are attacker-controlled, so the fallback can be triggered
+    // deliberately to place unverified content in a confirmation dialog.
+    if (error instanceof MaxSizeExceededError && getImageContentType(error.headers) && allowUnverifiedNftPreviews()) {
       return imageUri;
     }
 

packages/gui/src/electron/utils/allowUnverifiedNftPreviews.test.ts

@@ -0,0 +1,36 @@
+const mockReadPrefs = jest.fn<Record<string, any>, []>();
+
+jest.mock('../prefs', () => ({
+  readPrefs: mockReadPrefs,
+}));
+
+const { default: allowUnverifiedNftPreviews, NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF } =
+  jest.requireActual<typeof import('./allowUnverifiedNftPreviews')>('./allowUnverifiedNftPreviews');
+
+describe('allowUnverifiedNftPreviews', () => {
+  beforeEach(() => {
+    mockReadPrefs.mockReset();
+  });
+
+  it('is disabled when the preference has never been set', () => {
+    mockReadPrefs.mockReturnValue({});
+
+    expect(allowUnverifiedNftPreviews()).toBe(false);
+  });
+
+  it('is enabled only by an explicit boolean true', () => {
+    mockReadPrefs.mockReturnValue({ [NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF]: true });
+    expect(allowUnverifiedNftPreviews()).toBe(true);
+
+    mockReadPrefs.mockReturnValue({ [NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF]: 'true' });
+    expect(allowUnverifiedNftPreviews()).toBe(false);
+  });
+
+  it('fails closed when the preferences store cannot be read', () => {
+    mockReadPrefs.mockImplementation(() => {
+      throw new Error('userDataDir needs to be initialized');
+    });
+
+    expect(allowUnverifiedNftPreviews()).toBe(false);
+  });
+});

packages/gui/src/electron/utils/allowUnverifiedNftPreviews.ts

@@ -0,0 +1,18 @@
+import { readPrefs } from '../prefs';
+
+// Preference key shared with the renderer's useAllowUnverifiedNFTPreviews hook.
+// The renderer persists it through PreferencesAPI.SAVE into prefs.yaml, which
+// is the copy consulted here in the main process.
+export const NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF = 'nftAllowUnverifiedPreviews';
+
+// Whether confirmation-dialog previews may fall back to loading an NFT image
+// directly from its source URL when the image is too large to hash-verify.
+// Fails closed: an unreadable preferences store (e.g. before userData is
+// initialized) means no unverified content is shown.
+export default function allowUnverifiedNftPreviews(): boolean {
+  try {
+    return readPrefs()[NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF] === true;
+  } catch {
+    return false;
+  }
+}

packages/gui/src/hooks/useAllowUnverifiedNFTPreviews.ts

@@ -0,0 +1,11 @@
+import { usePrefs } from '@chia-network/api-react';
+
+// When enabled, transaction confirmation dialogs may load an NFT preview
+// directly from its source URL when the image is too large to verify against
+// its on-chain hash. Off by default — unverifiable previews are not shown.
+// The main process reads the persisted copy of this preference when resolving
+// previews (electron/utils/allowUnverifiedNftPreviews.ts); keep the key in
+// sync with NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF there.
+export default function useAllowUnverifiedNFTPreviews() {
+  return usePrefs<boolean>('nftAllowUnverifiedPreviews', false);
+}