Pig in a poke
A pig in a poke is a thing that is bought without first being inspected, and thus of unknown authenticity or quality. The idiom is attested in 1555:
A "poke" is a sack, so the image is of a concealed item being sold. Wikipedia