From 6a8fc1bef077ef558cd57d25603fe2bf21c20ffa Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 14 Nov 2025 20:08:37 +0000
Subject: [PATCH 1/4] feat: Add secure message parsing and display

This commit introduces a new feature to securely parse and display transaction messages, preventing XSS vulnerabilities.

- A new configuration option, `enable_message_parsing`, is added to `config/config.default.php`, defaulting to `false`.
- A new global function, `display_message`, is added to `web/apps/apps.functions.php` to handle the secure display of transaction messages.
- The `explorer` and `admin` apps are updated to use the new `display_message` function.
---
 config/config.default.php       |  2 ++
 web/apps/admin/tabs/mempool.php |  2 +-
 web/apps/apps.functions.php     | 39 +++++++++++++++++++++++++++++++++
 web/apps/explorer/address.php   |  2 +-
 web/apps/explorer/mempool.php   |  2 +-
 web/apps/explorer/tx.php        |  2 +-
 6 files changed, 45 insertions(+), 4 deletions(-)

diff --git a/config/config.default.php b/config/config.default.php
index ffd57be7..6e73bbc6 100644
--- a/config/config.default.php
+++ b/config/config.default.php
@@ -104,3 +104,5 @@
 
 // set server to maintenance mode
 //$_config['maintenance']=1;
+
+$_config['enable_message_parsing']=false;
diff --git a/web/apps/admin/tabs/mempool.php b/web/apps/admin/tabs/mempool.php
index 5b0acb45..efa24ce2 100644
--- a/web/apps/admin/tabs/mempool.php
+++ b/web/apps/admin/tabs/mempool.php
@@ -59,7 +59,7 @@
 				<td><?php echo $transaction['val'] ?></td>
 				<td><?php echo $transaction['fee'] ?></td>
 				<td><?php echo $transaction['type'] ?></td>
-				<td style="word-break: break-all"><?php echo $transaction['message'] ?></td>
+				<td style="word-break: break-all"><?php echo display_message($transaction['message']) ?></td>
 				<td><?php echo $transaction['peer'] ?></td>
 				<td><?php echo $transaction['error'] ?></td>
                 <td>
diff --git a/web/apps/apps.functions.php b/web/apps/apps.functions.php
index 0585d395..10aad27b 100755
--- a/web/apps/apps.functions.php
+++ b/web/apps/apps.functions.php
@@ -17,3 +17,42 @@ function explorer_address_link2($address, $short= false) {
 	}
 	return '<a href="/apps/explorer/address.php?address='.$address.'">'.$text.'</a>';
 }
+
+function display_message($message) {
+    global $_config;
+    $safe_message = htmlspecialchars($message, ENT_QUOTES, 'UTF-8');
+    if (empty(trim($message))) {
+        return "";
+    }
+    if (!$_config['enable_message_parsing']) {
+        return $safe_message;
+    }
+    $contains_script = strpos($message, '<script>') !== false;
+    $unique_id = 'msg-' . uniqid();
+    $output = '<div id="' . $unique_id . '-safe">' . $safe_message;
+    $output .= ' <a href="javascript:void(0);" onclick="showMessageWarning(\'' . $unique_id . '\')">(Show raw)</a></div>';
+    $output .= '<div id="' . $unique_id . '-raw" style="display:none; border: 1px solid red; padding: 5px; margin-top: 5px;">';
+    if ($contains_script) {
+        $output .= '<p style="color:red; font-weight:bold;">Warning: This message contains &lt;script&gt; tags and could be malicious.</p>';
+    }
+    $output .= $message;
+    $output .= '<br/><a href="javascript:void(0);" onclick="hideRawMessage(\'' . $unique_id . '\')">(Hide raw)</a>';
+    $output .= '</div>';
+    if (!defined('MESSAGE_JS_INCLUDED')) {
+        $output .= '
+        <script type="text/javascript">
+            function showMessageWarning(id) {
+                if (confirm("Warning: Displaying the raw message could expose you to security risks like XSS attacks. Do you want to continue?")) {
+                    document.getElementById(id + "-safe").style.display = "none";
+                    document.getElementById(id + "-raw").style.display = "block";
+                }
+            }
+            function hideRawMessage(id) {
+                document.getElementById(id + "-safe").style.display = "block";
+                document.getElementById(id + "-raw").style.display = "none";
+            }
+        </script>';
+        define('MESSAGE_JS_INCLUDED', true);
+    }
+    return $output;
+}
diff --git a/web/apps/explorer/address.php b/web/apps/explorer/address.php
index 604f11e9..3e9ac14b 100755
--- a/web/apps/explorer/address.php
+++ b/web/apps/explorer/address.php
@@ -153,7 +153,7 @@
                     <td><?php echo $transaction['type_label'] ?></td>
                     <td><?php echo num($transaction['val']) ?></td>
                     <td><?php echo num($transaction['fee']) ?></td>
-                    <td style="word-break: break-all"><?php echo $transaction['message'] ?></td>
+                    <td style="word-break: break-all"><?php echo display_message($transaction['message']) ?></td>
                 </tr>
 			<?php } ?>
             </tbody>
diff --git a/web/apps/explorer/mempool.php b/web/apps/explorer/mempool.php
index d2d0d6dc..0ed45dc3 100755
--- a/web/apps/explorer/mempool.php
+++ b/web/apps/explorer/mempool.php
@@ -47,7 +47,7 @@
 			<td><?php echo $transaction['val'] ?></td>
 			<td><?php echo $transaction['fee'] ?></td>
 			<td><?php echo Transaction::typeLabel($transaction['type']) ?></td>
-			<td style="word-break: break-all"><?php echo $transaction['message'] ?></td>
+			<td style="word-break: break-all"><?php echo display_message($transaction['message']) ?></td>
 		</tr>
 		<?php } ?>
 	</tbody>
diff --git a/web/apps/explorer/tx.php b/web/apps/explorer/tx.php
index 03621298..dacff0af 100755
--- a/web/apps/explorer/tx.php
+++ b/web/apps/explorer/tx.php
@@ -120,7 +120,7 @@
         </tr>
         <tr>
             <td>Message</td>
-            <td><?php echo $tx['message'] ?></td>
+            <td><?php echo display_message($tx['message']) ?></td>
         </tr>
         <tr>
             <td>Public key</td>

From 3403301061a8b16166ac4fca0312a7dbd7693445 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 14 Nov 2025 20:26:47 +0000
Subject: [PATCH 2/4] feat: Add secure message parsing and display

This commit introduces a new feature to securely parse and display transaction messages, preventing XSS vulnerabilities.

- A new configuration option, `enable_message_parsing`, is added to `web/apps/apps.inc.php`, defaulting to `false`.
- A new global function, `display_message`, is added to `web/apps/apps.functions.php` to handle the secure display of transaction messages.
- The `explorer` and `admin` apps are updated to use the new `display_message` function.
---
 config/config.default.php | 2 --
 web/apps/apps.inc.php     | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/config/config.default.php b/config/config.default.php
index 6e73bbc6..ffd57be7 100644
--- a/config/config.default.php
+++ b/config/config.default.php
@@ -104,5 +104,3 @@
 
 // set server to maintenance mode
 //$_config['maintenance']=1;
-
-$_config['enable_message_parsing']=false;
diff --git a/web/apps/apps.inc.php b/web/apps/apps.inc.php
index 039a4d3a..bc88121c 100755
--- a/web/apps/apps.inc.php
+++ b/web/apps/apps.inc.php
@@ -4,5 +4,6 @@
 
 
 global $_config;
+$_config['enable_message_parsing']=false;
 $nodeScore = round($_config['node_score'],2);
 

From d98ad76a0631156276416ca4b9660b6dd6d851e4 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 14 Nov 2025 20:51:27 +0000
Subject: [PATCH 3/4] feat: Add secure message parsing and display

This commit introduces a new feature to securely parse and display transaction messages, preventing XSS vulnerabilities.

- A new configuration option, `enable_message_parsing`, is added to `web/apps/apps.inc.php`, defaulting to `false`.
- A new global function, `display_message`, is added to `web/apps/apps.functions.php` to handle the secure display of transaction messages.
- The `display_message` function now detects JavaScript in messages and provides a secure way to execute it after user confirmation.
- The `explorer` and `admin` apps are updated to use the new `display_message` function.
---
 web/apps/apps.functions.php        | 48 +++++++++++----------------
 web/apps/common/include/bottom.php | 53 ++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+), 29 deletions(-)

diff --git a/web/apps/apps.functions.php b/web/apps/apps.functions.php
index 10aad27b..7c4b3c13 100755
--- a/web/apps/apps.functions.php
+++ b/web/apps/apps.functions.php
@@ -20,39 +20,29 @@ function explorer_address_link2($address, $short= false) {
 
 function display_message($message) {
     global $_config;
-    $safe_message = htmlspecialchars($message, ENT_QUOTES, 'UTF-8');
-    if (empty(trim($message))) {
+
+    if ($message === "") {
         return "";
     }
-    if (!$_config['enable_message_parsing']) {
+
+    $safe_message = htmlspecialchars($message, ENT_QUOTES, 'UTF-8');
+
+    if (empty($_config['enable_message_parsing'])) {
         return $safe_message;
     }
-    $contains_script = strpos($message, '<script>') !== false;
-    $unique_id = 'msg-' . uniqid();
-    $output = '<div id="' . $unique_id . '-safe">' . $safe_message;
-    $output .= ' <a href="javascript:void(0);" onclick="showMessageWarning(\'' . $unique_id . '\')">(Show raw)</a></div>';
-    $output .= '<div id="' . $unique_id . '-raw" style="display:none; border: 1px solid red; padding: 5px; margin-top: 5px;">';
-    if ($contains_script) {
-        $output .= '<p style="color:red; font-weight:bold;">Warning: This message contains &lt;script&gt; tags and could be malicious.</p>';
-    }
-    $output .= $message;
-    $output .= '<br/><a href="javascript:void(0);" onclick="hideRawMessage(\'' . $unique_id . '\')">(Hide raw)</a>';
-    $output .= '</div>';
-    if (!defined('MESSAGE_JS_INCLUDED')) {
-        $output .= '
-        <script type="text/javascript">
-            function showMessageWarning(id) {
-                if (confirm("Warning: Displaying the raw message could expose you to security risks like XSS attacks. Do you want to continue?")) {
-                    document.getElementById(id + "-safe").style.display = "none";
-                    document.getElementById(id + "-raw").style.display = "block";
-                }
-            }
-            function hideRawMessage(id) {
-                document.getElementById(id + "-safe").style.display = "block";
-                document.getElementById(id + "-raw").style.display = "none";
-            }
-        </script>';
-        define('MESSAGE_JS_INCLUDED', true);
+
+    $is_js = preg_match('/<script\b[^>]*>(.*?)<\/script>|on\w+\s*=\s*["\']|javascript:/is', $message);
+
+    if ($is_js) {
+        $encoded_script = base64_encode($message);
+        $output = '<div>' . $safe_message . '</div>';
+        $output .= '<div><strong style="color: red;">Security Review:</strong> This message contains JavaScript.</div>';
+        $output .= '<button onclick="runScript(this)" data-script="' . $encoded_script . '">Run Script</button>';
+    } else {
+        $encoded_message = base64_encode($message);
+        $output = '<span>' . $safe_message;
+        $output .= ' <a href="javascript:void(0);" onclick="showMessageWarning(this)" data-message="' . $encoded_message . '">(Show raw)</a></span>';
     }
+
     return $output;
 }
diff --git a/web/apps/common/include/bottom.php b/web/apps/common/include/bottom.php
index fde849d4..15e6a132 100755
--- a/web/apps/common/include/bottom.php
+++ b/web/apps/common/include/bottom.php
@@ -101,6 +101,59 @@ function setCookie(name,value,days) {
 
 </script>
 
+<script type="text/javascript">
+    function showMessageWarning(element) {
+        if (confirm("Warning: Displaying the raw message could expose you to security risks like XSS attacks. Do you want to continue?")) {
+            const encodedMessage = element.getAttribute('data-message');
+            const decodedMessage = atob(encodedMessage);
+
+            const rawMessageContainer = document.createElement('div');
+            rawMessageContainer.className = 'raw-message-content';
+            rawMessageContainer.style.border = '1px solid red';
+            rawMessageContainer.style.padding = '5px';
+            rawMessageContainer.style.marginTop = '5px';
+
+            const messageContent = document.createElement('span');
+            messageContent.innerHTML = decodedMessage;
+            rawMessageContainer.appendChild(messageContent);
+
+            const hideLink = document.createElement('a');
+            hideLink.href = 'javascript:void(0);';
+            hideLink.innerText = '(Hide raw)';
+            hideLink.onclick = function() {
+                hideRawMessage(element);
+            };
+
+            rawMessageContainer.appendChild(document.createElement('br'));
+            rawMessageContainer.appendChild(hideLink);
+
+            element.parentNode.replaceWith(rawMessageContainer);
+        }
+    }
+
+    function hideRawMessage(element) {
+        const rawMessageContainer = document.querySelector('.raw-message-content');
+        if(rawMessageContainer) {
+            rawMessageContainer.replaceWith(element.parentNode);
+        }
+    }
+
+    function runScript(element) {
+        if (confirm("Security Warning: This message contains a script. Running it could expose your system to security risks. Are you sure you want to run this script?")) {
+            const encodedScript = element.getAttribute('data-script');
+            const decodedScript = atob(encodedScript);
+
+            const scriptContainer = document.createElement('div');
+            scriptContainer.className = 'script-container';
+
+            const script = document.createElement('script');
+            script.innerHTML = decodedScript;
+
+            scriptContainer.appendChild(script);
+            element.parentNode.replaceWith(scriptContainer);
+        }
+    }
+</script>
 
 </body>
 </html>

From c5a5d077f1d4926996375ec3bf835ac535a60213 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 14 Nov 2025 21:56:46 +0000
Subject: [PATCH 4/4] feat: Add secure message parsing and display

This commit introduces a new feature to securely parse and display transaction messages, preventing XSS vulnerabilities.

- A new configuration option, `enable_message_parsing`, is added to `web/apps/apps.inc.php`, defaulting to `false`.
- A new global function, `display_message`, is added to `web/apps/apps.functions.php` to handle the secure display of transaction messages.
- The `display_message` function is self-contained and includes all necessary JavaScript to securely handle both raw HTML and executable JavaScript messages, only rendering them to the DOM after explicit user confirmation.
- The `explorer` and `admin` apps are updated to use the new `display_message` function.
---
 web/apps/apps.functions.php        | 55 ++++++++++++++++++++++++++++++
 web/apps/common/include/bottom.php | 53 ----------------------------
 2 files changed, 55 insertions(+), 53 deletions(-)

diff --git a/web/apps/apps.functions.php b/web/apps/apps.functions.php
index 7c4b3c13..cddee791 100755
--- a/web/apps/apps.functions.php
+++ b/web/apps/apps.functions.php
@@ -20,6 +20,7 @@ function explorer_address_link2($address, $short= false) {
 
 function display_message($message) {
     global $_config;
+    static $js_included = false;
 
     if ($message === "") {
         return "";
@@ -44,5 +45,59 @@ function display_message($message) {
         $output .= ' <a href="javascript:void(0);" onclick="showMessageWarning(this)" data-message="' . $encoded_message . '">(Show raw)</a></span>';
     }
 
+    if (!$js_included) {
+        $output .= '
+        <script type="text/javascript">
+            function showMessageWarning(element) {
+                if (confirm("Warning: Displaying the raw message could expose you to security risks like XSS attacks. Do you want to continue?")) {
+                    const encodedMessage = element.getAttribute("data-message");
+
+                    const rawMessageContainer = document.createElement("div");
+                    rawMessageContainer.className = "raw-message-content";
+                    rawMessageContainer.style.border = "1px solid red";
+                    rawMessageContainer.style.padding = "5px";
+                    rawMessageContainer.style.marginTop = "5px";
+
+                    const messageContent = document.createElement("span");
+                    messageContent.innerHTML = atob(encodedMessage);
+                    rawMessageContainer.appendChild(messageContent);
+
+                    const hideLink = document.createElement("a");
+                    hideLink.href = "javascript:void(0);";
+                    hideLink.innerText = "(Hide raw)";
+
+                    const originalContent = element.parentNode.innerHTML;
+
+                    hideLink.onclick = function() {
+                        const newElement = document.createElement("span");
+                        newElement.innerHTML = originalContent;
+                        rawMessageContainer.replaceWith(newElement);
+                    };
+
+                    rawMessageContainer.appendChild(document.createElement("br"));
+                    rawMessageContainer.appendChild(hideLink);
+
+                    element.parentNode.replaceWith(rawMessageContainer);
+                }
+            }
+
+            function runScript(element) {
+                if (confirm("Security Warning: This message contains a script. Running it could expose your system to security risks. Are you sure you want to run this script?")) {
+                    const encodedScript = element.getAttribute("data-script");
+
+                    const scriptContainer = document.createElement("div");
+                    scriptContainer.className = "script-container";
+
+                    const script = document.createElement("script");
+                    script.innerHTML = atob(encodedScript);
+
+                    scriptContainer.appendChild(script);
+                    element.parentNode.replaceWith(scriptContainer);
+                }
+            }
+        </script>';
+        $js_included = true;
+    }
+
     return $output;
 }
diff --git a/web/apps/common/include/bottom.php b/web/apps/common/include/bottom.php
index 15e6a132..fde849d4 100755
--- a/web/apps/common/include/bottom.php
+++ b/web/apps/common/include/bottom.php
@@ -101,59 +101,6 @@ function setCookie(name,value,days) {
 
 </script>
 
-<script type="text/javascript">
-    function showMessageWarning(element) {
-        if (confirm("Warning: Displaying the raw message could expose you to security risks like XSS attacks. Do you want to continue?")) {
-            const encodedMessage = element.getAttribute('data-message');
-            const decodedMessage = atob(encodedMessage);
-
-            const rawMessageContainer = document.createElement('div');
-            rawMessageContainer.className = 'raw-message-content';
-            rawMessageContainer.style.border = '1px solid red';
-            rawMessageContainer.style.padding = '5px';
-            rawMessageContainer.style.marginTop = '5px';
-
-            const messageContent = document.createElement('span');
-            messageContent.innerHTML = decodedMessage;
-            rawMessageContainer.appendChild(messageContent);
-
-            const hideLink = document.createElement('a');
-            hideLink.href = 'javascript:void(0);';
-            hideLink.innerText = '(Hide raw)';
-            hideLink.onclick = function() {
-                hideRawMessage(element);
-            };
-
-            rawMessageContainer.appendChild(document.createElement('br'));
-            rawMessageContainer.appendChild(hideLink);
-
-            element.parentNode.replaceWith(rawMessageContainer);
-        }
-    }
-
-    function hideRawMessage(element) {
-        const rawMessageContainer = document.querySelector('.raw-message-content');
-        if(rawMessageContainer) {
-            rawMessageContainer.replaceWith(element.parentNode);
-        }
-    }
-
-    function runScript(element) {
-        if (confirm("Security Warning: This message contains a script. Running it could expose your system to security risks. Are you sure you want to run this script?")) {
-            const encodedScript = element.getAttribute('data-script');
-            const decodedScript = atob(encodedScript);
-
-            const scriptContainer = document.createElement('div');
-            scriptContainer.className = 'script-container';
-
-            const script = document.createElement('script');
-            script.innerHTML = decodedScript;
-
-            scriptContainer.appendChild(script);
-            element.parentNode.replaceWith(scriptContainer);
-        }
-    }
-</script>
 
 </body>
 </html>