From e3310a34fd08b7c06e3e0be75a180cd675902ce7 Mon Sep 17 00:00:00 2001
From: a1denvalu3 <43107113+a1denvalu3@users.noreply.github.com>
Date: Thu, 15 Jan 2026 07:42:50 +0100
Subject: [PATCH] security: prevent storage exhaustion by saving incoming files
 to cache (#606)

Closes #592
- Changed FileUtils.saveIncomingFile to use context.cacheDir instead of context.filesDir.
- This ensures incoming files are treated as temporary and can be cleared by the OS if space is needed.

Co-authored-by: a1denvalu3 <>
---
 .../main/java/com/bitchat/android/features/file/FileUtils.kt  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/src/main/java/com/bitchat/android/features/file/FileUtils.kt b/app/src/main/java/com/bitchat/android/features/file/FileUtils.kt
index e1016b11..a1f83a7e 100644
--- a/app/src/main/java/com/bitchat/android/features/file/FileUtils.kt
+++ b/app/src/main/java/com/bitchat/android/features/file/FileUtils.kt
@@ -197,7 +197,9 @@ object FileUtils {
     ): String {
         val lowerMime = file.mimeType.lowercase()
         val isImage = lowerMime.startsWith("image/")
-        val baseDir = context.filesDir
+        // FIX: Use cacheDir instead of filesDir to prevent storage exhaustion attacks (Issue #592)
+        // Files in cacheDir are eligible for automatic system cleanup when space is low
+        val baseDir = context.cacheDir
         val subdir = if (isImage) "images/incoming" else "files/incoming"
         val dir = java.io.File(baseDir, subdir).apply { mkdirs() }