From 3e567e396c302c2ce006630d277b9e2506736a3f Mon Sep 17 00:00:00 2001
From: Moe Hamade <69801237+moehamade@users.noreply.github.com>
Date: Fri, 24 Jul 2026 17:13:13 +0300
Subject: [PATCH] fix: Harden hotspot server and release metadata fetching

- ApkWebServer only serves the exact /bitchat.apk path instead of any
  *.apk-suffixed URI.
- GitHubReleaseClient uses the shared OkHttpProvider (respects Tor proxy)
  and drops the loose 'any lone 64-hex string in the release notes is the
  checksum' fallback, which was spoofable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../com/bitchat/android/hotspot/ApkWebServer.kt |  2 +-
 .../bitchat/android/util/GitHubReleaseClient.kt | 17 ++---------------
 2 files changed, 3 insertions(+), 16 deletions(-)

diff --git a/app/src/main/java/com/bitchat/android/hotspot/ApkWebServer.kt b/app/src/main/java/com/bitchat/android/hotspot/ApkWebServer.kt
index 3e396cb9..5d763fee 100644
--- a/app/src/main/java/com/bitchat/android/hotspot/ApkWebServer.kt
+++ b/app/src/main/java/com/bitchat/android/hotspot/ApkWebServer.kt
@@ -41,7 +41,7 @@ class ApkWebServer(
         Log.d(TAG, "Request: ${session.method} $uri from ${session.remoteIpAddress}")
 
         return when {
-            uri.endsWith(".apk") || uri == "/bitchat.apk" -> {
+            uri == "/bitchat.apk" -> {
                 serveApk()
             }
             uri == "/favicon.ico" -> {
diff --git a/app/src/main/java/com/bitchat/android/util/GitHubReleaseClient.kt b/app/src/main/java/com/bitchat/android/util/GitHubReleaseClient.kt
index e157b65c..28e2ec50 100644
--- a/app/src/main/java/com/bitchat/android/util/GitHubReleaseClient.kt
+++ b/app/src/main/java/com/bitchat/android/util/GitHubReleaseClient.kt
@@ -3,11 +3,10 @@ package com.bitchat.android.util
 import android.util.Log
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
-import okhttp3.OkHttpClient
+import com.bitchat.android.net.OkHttpProvider
 import okhttp3.Request
 import org.json.JSONObject
 import java.io.IOException
-import java.util.concurrent.TimeUnit
 
 /**
  * Client for fetching BitChat release information from GitHub API.
@@ -17,10 +16,7 @@ object GitHubReleaseClient {
     private const val GITHUB_API_URL = "https://api.github.com/repos/permissionlesstech/bitchat-android/releases/latest"
     private const val USER_AGENT = "BitChat-Android"
 
-    private val client = OkHttpClient.Builder()
-        .connectTimeout(15, TimeUnit.SECONDS)
-        .readTimeout(30, TimeUnit.SECONDS)
-        .build()
+    private val client get() = OkHttpProvider.httpClient()
 
     /**
      * Fetch the latest release information from GitHub.
@@ -145,15 +141,6 @@ object GitHubReleaseClient {
                 return match.groupValues[1].lowercase()
             }
 
-            // Pattern 3: Look for any SHA256 hash (64 hex characters)
-            val hashPattern = Regex("""([a-fA-F0-9]{64})""")
-            val matches = hashPattern.findAll(body).toList()
-
-            // If we find exactly one hash, assume it's for the universal APK
-            if (matches.size == 1) {
-                return matches[0].groupValues[1].lowercase()
-            }
-
             Log.w(TAG, "Could not extract SHA256 from release body")
             return null