What the developer wrote
Authored by Nicolas Dorier
Small fixup
What changed, and why it matters
This commit is a minor cleanup: it changes how an 'empty transactions' message is created on a wallet page. Previously the message was stored as a chunk of HTML in translation files; now it is built safely in code with plain text. There is no security issue here—just a small improvement in how the page is assembled.
No action required. This is a benign refactor. If reviewing related code, continue migrating innerHTML usages to safe DOM construction where localized strings contain HTML.
Security signals we found
innerHTML replaced with safe DOM construction (textContent + createElement)
Localization key changed from HTML string to plain text string
No user-controlled input observed in the affected code path
Evidence from the diff
The patch refactors the empty-state rendering in WalletTransactions.cshtml. Instead of localizing an HTML string (<div class="text-secondary" data-loaded="true">There are no transactions yet.</div>) and injecting it via innerHTML, it creates a div element, sets class and data attribute imperatively, and assigns localized text via textContent. The translation key is also updated from the HTML string to the plain text string. This is a defensive coding improvement that reduces HTML injection surface, but there is no evidence of an exploitable vulnerability in the prior code because the value came from the application’s own localization resource, not user input.
Changed components
BTCPayServer/Plugins/Wallets/Views/UIWallets/WalletTransactions.cshtmlBTCPayServer/Plugins/Translations/Translations.Default.csInspect captured patch +6 / −2
diff --git a/BTCPayServer/Plugins/Translations/Translations.Default.cs b/BTCPayServer/Plugins/Translations/Translations.Default.cs
index cbd7886..14e76a7 100644
--- a/BTCPayServer/Plugins/Translations/Translations.Default.cs
+++ b/BTCPayServer/Plugins/Translations/Translations.Default.cs
@@ -55,7 +55,6 @@ namespace BTCPayServer.Plugins.Translations
"@submitLabel": "",
"<code>itemcode:code</code> for filtering a specific type of item purchased through the pos or crowdfund apps": "",
"<code>orderid:id</code> for filtering a specific order": "",
- "<div class=\"text-secondary\" data-loaded=\"true\">There are no transactions yet.</div>": "",
"<p>Passkeys are a simpler and safer way to sign in — no login or password required.</p>\n <p>\n With passkeys, users can log in using the same method they already use to unlock their device,\n such as Face ID, Touch ID, Windows Hello, Android biometrics, or a hardware security key such as Yubikey.\n </p>": "",
"<span class=\"currency\">{0}</span> closing channels": "",
"<span class=\"currency\">{0}</span> confirmed": "",
@@ -1961,6 +1960,7 @@ namespace BTCPayServer.Plugins.Translations
"There are no stores yet.": "",
"There are no subscribers.": "",
"There are no subscription plans.": "",
+ "There are no transactions yet.": "",
"There are no wallets yet. You can add wallets in the store setup.": "",
"There are no webhooks yet.": "",
"There isn't any UTXO available to bump fee with CPFP": "",
diff --git a/BTCPayServer/Plugins/Wallets/Views/UIWallets/WalletTransactions.cshtml b/BTCPayServer/Plugins/Wallets/Views/UIWallets/WalletTransactions.cshtml
index a17817b..95f9bd1 100644
--- a/BTCPayServer/Plugins/Wallets/Views/UIWallets/WalletTransactions.cshtml
+++ b/BTCPayServer/Plugins/Wallets/Views/UIWallets/WalletTransactions.cshtml
@@ -144,7 +144,11 @@
// replace table and dropdowns if initial response was empty
if (responseEmpty) {
$dropdowns.remove();
- $transactions.innerHTML = @Safe.Json(StringLocalizer["<div class=\"text-secondary\" data-loaded=\"true\">There are no transactions yet.</div>"].Value);
+ const emptyMessage = document.createElement('div');
+ emptyMessage.classList.add('text-secondary');
+ emptyMessage.dataset.loaded = 'true';
+ emptyMessage.textContent = @Safe.Json(StringLocalizer["There are no transactions yet."].Value);
+ $transactions.replaceChildren(emptyMessage);
}
}
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.