Merge branch 'nft-3-preview-hardening' into nft-4-ipfs-gateway

# Conflicts:
#	packages/gui/src/components/settings/SettingsNFT.tsx
#	packages/gui/src/electron/api/nftGetMetadata.test.ts
#	packages/gui/src/electron/api/nftGetMetadata.ts

Author: jlobue10

packages/gui/src/components/settings/SettingsNFT.tsx

@@ -14,6 +14,7 @@ import { Trans } from '@lingui/macro';
 import { Grid, Button, Switch, FormControlLabel, Typography } from '@mui/material';
 import React from 'react';
 
+import useAllowUnverifiedNFTPreviews from '../../hooks/useAllowUnverifiedNFTPreviews';
 import useCache from '../../hooks/useCache';
 import useHideObjectionableContent from '../../hooks/useHideObjectionableContent';
 import useIpfsGateway from '../../hooks/useIpfsGateway';
@@ -42,6 +43,7 @@ export default function SettingsGeneral() {
   const [nftImageFittingMode, setNFTImageFittingMode] = useNFTImageFittingMode();
   const [nftVideoLoop, setNFTVideoLoop] = useNFTVideoLoopGlobal();
   const [ipfsGateway, setIpfsGateway] = useIpfsGateway();
+  const [allowUnverifiedPreviews, setAllowUnverifiedPreviews] = useAllowUnverifiedNFTPreviews();
   // const [, setCacheFolder] = usePrefs('cacheFolder', '');
   const openDialog = useOpenDialog();
 
@@ -57,6 +59,10 @@ export default function SettingsGeneral() {
     setIpfsGateway(event.target.checked);
   }
 
+  function handleChangeAllowUnverifiedPreviews(event: React.ChangeEvent<HTMLInputElement>) {
+    setAllowUnverifiedPreviews(event.target.checked);
+  }
+
   async function clearNFTCache() {
     openDialog(
       <ConfirmDialog
@@ -170,6 +176,28 @@ export default function SettingsGeneral() {
         </Grid>
       </Grid>
 
+      <Grid container>
+        <Grid item style={{ width: '400px' }}>
+          <SettingsTitle>
+            <Trans>Show unverified previews</Trans>
+          </SettingsTitle>
+        </Grid>
+        <Grid item container xs justifyContent="flex-end" marginTop="-6px">
+          <FormControlLabel
+            control={<Switch checked={allowUnverifiedPreviews} onChange={handleChangeAllowUnverifiedPreviews} />}
+          />
+        </Grid>
+        <Grid item style={{ width: '400px' }}>
+          <SettingsText>
+            <Trans>
+              When an NFT image is too large to verify against its on-chain hash, load the transaction confirmation
+              preview directly from its source URL without verification. When disabled, no preview is shown for these
+              NFTs.
+            </Trans>
+          </SettingsText>
+        </Grid>
+      </Grid>
+
       <Grid item style={{ maxWidth: '400px' }}>
         <Flex flexDirection="column" gap={1}>
           <SettingsSection>

packages/gui/src/electron/api/nftGetMetadata.test.ts

@@ -18,6 +18,13 @@ jest.mock('../utils/ipfsGateway', () => ({
   default: mockMaybeIpfsToGatewayUrl,
 }));
 
+const mockAllowUnverifiedNftPreviews = jest.fn<boolean, []>();
+
+jest.mock('../utils/allowUnverifiedNftPreviews', () => ({
+  __esModule: true,
+  default: mockAllowUnverifiedNftPreviews,
+}));
+
 const { MaxSizeExceededError } = jest.requireActual<typeof import('../utils/fetchBuffer')>('../utils/fetchBuffer');
 
 const ipfsToGatewayUrl = jest.requireActual<typeof import('../../util/ipfs')>('../../util/ipfs').default;
@@ -71,6 +78,8 @@ describe('nftGetImageDataUrl', () => {
     mockMaybeIpfsToGatewayUrl.mockReset();
     // gateway option off: URLs pass through untranslated
     mockMaybeIpfsToGatewayUrl.mockImplementation((url) => url);
+    mockAllowUnverifiedNftPreviews.mockReset();
+    mockAllowUnverifiedNftPreviews.mockReturnValue(false);
   });
 
   it('returns an immutable data URL for a verified image response', async () => {
@@ -104,7 +113,18 @@ describe('nftGetImageDataUrl', () => {
     expect(mockFetchBuffer).not.toHaveBeenCalled();
   });
 
-  it('falls back to the direct URL when an image response exceeds the size cap', async () => {
+  it('omits the preview for an oversized image response by default', async () => {
+    mockFetchBuffer.mockRejectedValue(
+      new MaxSizeExceededError({
+        'content-type': 'image/gif',
+      }),
+    );
+
+    await expect(nftGetImageDataUrl('https://example.com/large.gif', '00')).resolves.toBeUndefined();
+  });
+
+  it('falls back to the direct URL for an oversized image when unverified previews are enabled', async () => {
+    mockAllowUnverifiedNftPreviews.mockReturnValue(true);
     mockFetchBuffer.mockRejectedValue(
       new MaxSizeExceededError({
         'content-type': 'image/gif',
@@ -116,7 +136,8 @@ describe('nftGetImageDataUrl', () => {
     );
   });
 
-  it('falls back to the gateway URL for an oversized ipfs image when the gateway option is on', async () => {
+  it('falls back to the gateway URL for an oversized ipfs image when both options are on', async () => {
+    mockAllowUnverifiedNftPreviews.mockReturnValue(true);
     mockMaybeIpfsToGatewayUrl.mockImplementation(ipfsToGatewayUrl);
     mockFetchBuffer.mockRejectedValue(
       new MaxSizeExceededError({
@@ -132,18 +153,32 @@ describe('nftGetImageDataUrl', () => {
   });
 
   it('omits the preview for an oversized ipfs image while the gateway option is off', async () => {
+    mockAllowUnverifiedNftPreviews.mockReturnValue(true);
     mockFetchBuffer.mockRejectedValue(
       new MaxSizeExceededError({
         'content-type': 'image/gif',
       }),
     );
 
     // an untranslated ipfs URI would be blocked by the dialog CSP, so no
-    // preview is returned at all
+    // preview is returned at all even though unverified previews are allowed
+    await expect(nftGetImageDataUrl('ipfs://bafybeigdyrztest/large.gif', '00')).resolves.toBeUndefined();
+  });
+
+  it('omits the preview for an oversized ipfs image while unverified previews are off', async () => {
+    mockMaybeIpfsToGatewayUrl.mockImplementation(ipfsToGatewayUrl);
+    mockFetchBuffer.mockRejectedValue(
+      new MaxSizeExceededError({
+        'content-type': 'image/gif',
+      }),
+    );
+
+    // the gateway option alone does not opt into unverified fallbacks
     await expect(nftGetImageDataUrl('ipfs://bafybeigdyrztest/large.gif', '00')).resolves.toBeUndefined();
   });
 
-  it('rejects an oversized response that is not an image', async () => {
+  it('rejects an oversized response that is not an image even when unverified previews are enabled', async () => {
+    mockAllowUnverifiedNftPreviews.mockReturnValue(true);
     mockFetchBuffer.mockRejectedValue(
       new MaxSizeExceededError({
         'content-type': 'video/mp4',

packages/gui/src/electron/api/nftGetMetadata.ts

@@ -3,6 +3,7 @@ import crypto from 'node:crypto';
 import type Headers from '../../@types/Headers';
 import compareChecksums from '../../util/compareChecksums';
 import { isIpfsUrl } from '../../util/ipfs';
+import allowUnverifiedNftPreviews from '../utils/allowUnverifiedNftPreviews';
 import fetchBuffer, { MaxSizeExceededError } from '../utils/fetchBuffer';
 import maybeIpfsToGatewayUrl from '../utils/ipfsGateway';
 
@@ -99,12 +100,15 @@ export async function nftGetImageDataUrl(
     return `data:${contentType};base64,${data.toString('base64')}`;
   } catch (error) {
     // An image too large to inline cannot be hash-verified without unbounded
-    // buffering. Fall back to the direct URL — the dialog CSP still allows
-    // https: images, matching the pre-verification behavior for these files.
-    // The CSP does not allow the ipfs: scheme, so ipfs URIs fall back to
-    // their gateway form, and only when the user has enabled the gateway —
-    // otherwise they get no preview rather than a CSP-blocked URL.
-    if (error instanceof MaxSizeExceededError && getImageContentType(error.headers)) {
+    // buffering. When the user has opted in, fall back to the direct URL — the
+    // dialog CSP still allows https: images, matching the pre-verification
+    // behavior for these files. Off by default: the response's size and type
+    // claims are attacker-controlled, so the fallback can be triggered
+    // deliberately to place unverified content in a confirmation dialog.
+    // The CSP does not allow the ipfs: scheme either, so ipfs URIs fall back
+    // to their gateway form, and only when the user has also enabled the
+    // gateway — otherwise they get no preview rather than a CSP-blocked URL.
+    if (error instanceof MaxSizeExceededError && getImageContentType(error.headers) && allowUnverifiedNftPreviews()) {
       const directUrl = maybeIpfsToGatewayUrl(imageUri);
       return isIpfsUrl(directUrl) ? undefined : directUrl;
     }

packages/gui/src/electron/utils/allowUnverifiedNftPreviews.test.ts

@@ -0,0 +1,36 @@
+const mockReadPrefs = jest.fn<Record<string, any>, []>();
+
+jest.mock('../prefs', () => ({
+  readPrefs: mockReadPrefs,
+}));
+
+const { default: allowUnverifiedNftPreviews, NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF } =
+  jest.requireActual<typeof import('./allowUnverifiedNftPreviews')>('./allowUnverifiedNftPreviews');
+
+describe('allowUnverifiedNftPreviews', () => {
+  beforeEach(() => {
+    mockReadPrefs.mockReset();
+  });
+
+  it('is disabled when the preference has never been set', () => {
+    mockReadPrefs.mockReturnValue({});
+
+    expect(allowUnverifiedNftPreviews()).toBe(false);
+  });
+
+  it('is enabled only by an explicit boolean true', () => {
+    mockReadPrefs.mockReturnValue({ [NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF]: true });
+    expect(allowUnverifiedNftPreviews()).toBe(true);
+
+    mockReadPrefs.mockReturnValue({ [NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF]: 'true' });
+    expect(allowUnverifiedNftPreviews()).toBe(false);
+  });
+
+  it('fails closed when the preferences store cannot be read', () => {
+    mockReadPrefs.mockImplementation(() => {
+      throw new Error('userDataDir needs to be initialized');
+    });
+
+    expect(allowUnverifiedNftPreviews()).toBe(false);
+  });
+});

packages/gui/src/electron/utils/allowUnverifiedNftPreviews.ts

@@ -0,0 +1,18 @@
+import { readPrefs } from '../prefs';
+
+// Preference key shared with the renderer's useAllowUnverifiedNFTPreviews hook.
+// The renderer persists it through PreferencesAPI.SAVE into prefs.yaml, which
+// is the copy consulted here in the main process.
+export const NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF = 'nftAllowUnverifiedPreviews';
+
+// Whether confirmation-dialog previews may fall back to loading an NFT image
+// directly from its source URL when the image is too large to hash-verify.
+// Fails closed: an unreadable preferences store (e.g. before userData is
+// initialized) means no unverified content is shown.
+export default function allowUnverifiedNftPreviews(): boolean {
+  try {
+    return readPrefs()[NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF] === true;
+  } catch {
+    return false;
+  }
+}

packages/gui/src/hooks/useAllowUnverifiedNFTPreviews.ts

@@ -0,0 +1,11 @@
+import { usePrefs } from '@chia-network/api-react';
+
+// When enabled, transaction confirmation dialogs may load an NFT preview
+// directly from its source URL when the image is too large to verify against
+// its on-chain hash. Off by default — unverifiable previews are not shown.
+// The main process reads the persisted copy of this preference when resolving
+// previews (electron/utils/allowUnverifiedNftPreviews.ts); keep the key in
+// sync with NFT_ALLOW_UNVERIFIED_PREVIEWS_PREF there.
+export default function useAllowUnverifiedNFTPreviews() {
+  return usePrefs<boolean>('nftAllowUnverifiedPreviews', false);
+}