Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

uric/contact: fix display name and contact header uri escaping #762

Merged
merged 6 commits into from
May 2, 2023

Conversation

maximilianfridrich
Copy link
Contributor

@maximilianfridrich maximilianfridrich commented Apr 13, 2023

In re, display names are always sent as quoted-string which must not be escaped. Further, basically all UTF-8 characters are allowed in quoted-strings, so not checking it should be fine for almost all cases. The relevant rules in the BNF of RFC 3261 section 25.1:

      UTF8-NONASCII   =  %xC0-DF 1UTF8-CONT
                      /  %xE0-EF 2UTF8-CONT
                      /  %xF0-F7 3UTF8-CONT
                      /  %xF8-Fb 4UTF8-CONT
                      /  %xFC-FD 5UTF8-CONT
      UTF8-CONT       =  %x80-BF

      quoted-string  =  SWS DQUOTE *(qdtext / quoted-pair ) DQUOTE
      qdtext         =  LWS / %x21 / %x23-5B / %x5D-7E
                        / UTF8-NONASCII
      quoted-pair  =  "\" (%x00-09 / %x0B-0C
                      / %x0E-7F)

      display-name   =  *(token LWS)/ quoted-string

So the special character 0x00-0x20 (execpt LWS), 0x7F, '', '"', CR and LF are not allowed. And the quoted-pair rules even allows '"' and '\' (and any other ASCII character except for CR and LF) as long as they are preceded by a '\'.

Also, SIP URIs in the Contact header must be escaped.

In display names, LWS may not be escaped according to RFC 3261 section
25.1.
@maximilianfridrich maximilianfridrich changed the title uric: fix display name uri escaping uric/contact: fix display name and contact header uri escaping Apr 13, 2023
@cspiel1
Copy link
Collaborator

cspiel1 commented Apr 14, 2023

Looks good to me.

Escaping URI parameters will be handled in a separate PR.

The display name is sent as a quoted-string which must not be escaped.
Further, basically all UTF-8 characters are allowed in display names,
so not checking it should be fine for almost all cases.
@cspiel1
Copy link
Collaborator

cspiel1 commented Apr 17, 2023

Then we should remove uri_display_name_escape() completely. It is currently not used.

@cspiel1
Copy link
Collaborator

cspiel1 commented Apr 17, 2023

We shortly added this function. So most likely nobody depends on it.
The PR looks good for me.

vgcore.51007 Outdated Show resolved Hide resolved
@alfredh
Copy link
Contributor

alfredh commented May 2, 2023

I think this one looks ready for merge ...

@sreimers sreimers merged commit 5aaffb6 into baresip:main May 2, 2023
KORuL pushed a commit to KORuL/re that referenced this pull request May 11, 2023
…ip#762)

* uric: fix display name uri escaping

In display names, LWS may not be escaped according to RFC 3261 section
25.1.

* contact: escape Contact header SIP URI

* uri,contact: improve uri escaping of user part

* dialog: do not escape display name in FROM header

The display name is sent as a quoted-string which must not be escaped.
Further, basically all UTF-8 characters are allowed in display names,
so not checking it should be fine for almost all cases.

* uric: remove unused functions
@maximilianfridrich maximilianfridrich deleted the disp_name_fix branch May 15, 2023 07:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants