aunix/wvp-GB28181-pro
1
0
Fork 0
mirror of https://gitee.com/pan648540858/wvp-GB28181-pro.git synced 2026-05-06 14:07:49 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Pre Merge pull request !46 from 阿斌/N/A

Browse Source
This commit is contained in:
阿斌 2026-04-20 10:58:03 +00:00 committed by Gitee
commit ae273e3525
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/main/java/com/genersoft/iot/vmp/gb28181/utils/SipUtils.java
View File

@ -204,6 +204,21 @@ public class SipUtils {
}
public static Gb28181Sdp parseSDP(String sdpStr) throws SdpParseException {
// 校验：拦截空内容与注入攻击特征
if (sdpStr == null || sdpStr.trim().isEmpty()) {
throw new SdpParseException(0, 0, "SDP内容为空");
}
// 标准SDP每行格式固定为 "x=value"，不存在SQL关键字；出现则视为注入攻击
String sdpUpper = sdpStr.toUpperCase();
if (sdpUpper.contains("' OR '") || sdpUpper.contains("' OR 1") || sdpUpper.contains(" OR 1=1")
|| sdpUpper.contains("--") || sdpUpper.contains("/*") || sdpUpper.contains("*/")
|| sdpUpper.contains("DROP ") || sdpUpper.contains("INSERT ") || sdpUpper.contains("UPDATE ")
|| sdpUpper.contains("DELETE ") || sdpUpper.contains("UNION ") || sdpUpper.contains("SELECT ")) {
log.error("[SDP注入攻击] 检测到非法SDP内容，已拒绝解析，内容长度: {}", sdpStr.length());
throw new SdpParseException(0, 0, "非法SDP内容");
}
//校验结束
// jainSip不支持y= f=字段， 移除以解析。
int ssrcIndex = sdpStr.indexOf("y=");