nik/bitchat-android
1
0
Fork 0
mirror of https://github.com/permissionlesstech/bitchat-android.git synced 2026-11-01 07:51:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Harden hotspot server and release metadata fetching

Browse Source 
- ApkWebServer only serves the exact /bitchat.apk path instead of any
  *.apk-suffixed URI.
- GitHubReleaseClient uses the shared OkHttpProvider (respects Tor proxy)
  and drops the loose 'any lone 64-hex string in the release notes is the
  checksum' fallback, which was spoofable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Moe Hamade 2026-07-24 17:13:13 +03:00
parent 075548249a
commit 3e567e396c
2 changed files with 3 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/src/main/java/com/bitchat/android/hotspot/ApkWebServer.kt
View File

@ -41,7 +41,7 @@ class ApkWebServer(
Log.d(TAG, "Request: ${session.method} $uri from ${session.remoteIpAddress}")
return when {
uri.endsWith(".apk") || uri == "/bitchat.apk" -> {
uri == "/bitchat.apk" -> {
serveApk()
}
uri == "/favicon.ico" -> {

17
app/src/main/java/com/bitchat/android/util/GitHubReleaseClient.kt
View File

@ -3,11 +3,10 @@ package com.bitchat.android.util
import android.util.Log
import kotlinx.coroutines.Dispatchers
import kotlinx.coroutines.withContext
import okhttp3.OkHttpClient
import com.bitchat.android.net.OkHttpProvider
import okhttp3.Request
import org.json.JSONObject
import java.io.IOException
import java.util.concurrent.TimeUnit
/**
* Client for fetching BitChat release information from GitHub API.
@ -17,10 +16,7 @@ object GitHubReleaseClient {
private const val GITHUB_API_URL = "https://api.github.com/repos/permissionlesstech/bitchat-android/releases/latest"
private const val USER_AGENT = "BitChat-Android"
private val client = OkHttpClient.Builder()
.connectTimeout(15, TimeUnit.SECONDS)
.readTimeout(30, TimeUnit.SECONDS)
.build()
private val client get() = OkHttpProvider.httpClient()
/**
* Fetch the latest release information from GitHub.
@ -145,15 +141,6 @@ object GitHubReleaseClient {
return match.groupValues[1].lowercase()
}
// Pattern 3: Look for any SHA256 hash (64 hex characters)
val hashPattern = Regex("""([a-fA-F0-9]{64})""")
val matches = hashPattern.findAll(body).toList()
// If we find exactly one hash, assume it's for the universal APK
if (matches.size == 1) {
return matches[0].groupValues[1].lowercase()
}
Log.w(TAG, "Could not extract SHA256 from release body")
return null