From 66166e90e3f418cf2e1edcbc1e5d8c57a19cc08b Mon Sep 17 00:00:00 2001
From: Juha Heinanen <jh@tutpro.com>
Date: Wed, 21 Jul 2021 11:05:24 +0300
Subject: [PATCH] Improved checking of SIP URI parameters

---
 .../main/kotlin/com/tutpro/baresip/Utils.kt    | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/app/src/main/kotlin/com/tutpro/baresip/Utils.kt b/app/src/main/kotlin/com/tutpro/baresip/Utils.kt
index 3397a1ac..44a293fd 100644
--- a/app/src/main/kotlin/com/tutpro/baresip/Utils.kt
+++ b/app/src/main/kotlin/com/tutpro/baresip/Utils.kt
@@ -220,18 +220,26 @@ object Utils {
     }
 
     private fun checkParam(param: String): Boolean {
-        /* Todo: do proper check */
         val nameValue = param.split("=")
         if (nameValue.size == 1)
-            return true
+            return checkParamChars(nameValue[0])
         if (nameValue.size == 2) {
-            if ((nameValue[0] == "transport") &&
-                setOf("udp", "tcp", "tls", "wss").contains(nameValue[1].lowercase()))
-            return true
+            if (nameValue[0] == "transport")
+                return setOf("udp", "tcp", "tls", "wss").contains(nameValue[1].lowercase())
+            return checkParamChars(nameValue[1])
         }
         return false
     }
 
+    private fun checkParamChars(s: String): Boolean {
+        // Does not currently allow escaped characters
+        val allowed = "[]/:&+$-_.!~*'()"
+        for (c in s)
+            if (!allowed.contains(c) && !c.isLetterOrDigit())
+                return false
+        return true
+    }
+
     fun paramValue(params: String, name: String): String {
         if (params == "") return ""
         for (param in params.split(";"))