From 13a2ca68f5c80fe674f150c36e1fec4d224ae37b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niels=20G=C3=B6ttsch?= <niels@ziemlichoptimal.de>
Date: Sun, 14 Jun 2026 19:32:03 +0200
Subject: [PATCH] stripSDP: use allowlist for a= lines instead of blocklist

---
 crypto.js | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/crypto.js b/crypto.js
index 1e0f0e0..fb36749 100644
--- a/crypto.js
+++ b/crypto.js
@@ -71,9 +71,16 @@ function hexToBuf(hex) {
 
 /* ─── QR compression: deflate-raw + base45 ─── */
 
+const SDP_ALLOW_A_PREFIXES = ['a=ice-ufrag:', 'a=ice-pwd:', 'a=fingerprint:', 'a=candidate:', 'a=end-of-candidates'];
+
 function stripSDP(sdp) {
-  return sdp.split(/\r?\n/).map(line => {
-    if (line === '' || line.startsWith('a=max-message-size:') || line.startsWith('a=sctp-port:')) return null;
+  return sdp.split(/\r?\n/).filter(line => {
+    if (!line) return false;
+    if (line.startsWith('a=')) {
+      return SDP_ALLOW_A_PREFIXES.some(p => line.startsWith(p));
+    }
+    return true;
+  }).map(line => {
     if (!line.startsWith('a=candidate:')) return line;
     const parts = line.split(' ');
     if (parts[2] === 'tcp') return null;