Pre Merge pull request !46 from 阿斌/N/A

更新README
提升数据库更新脚本兼容性，修复推流视频音频BUG
2026-06-29 21:47:50 +08:00 · 2026-06-09 08:48:05 +00:00 · 2026-06-09 16:47:41 +08:00 · 2026-06-08 16:23:41 +08:00 · 2026-03-21 16:15:47 +00:00
4 changed files with 52 additions and 8 deletions
--- a/README.md
+++ b/README.md
@ -165,7 +165,19 @@ https://gitee.com/pan648540858/wvp-GB28181-pro.git
    - 版本信息（软件、编码、面板、硬件的版本号）
    - 编码配置（主辅码流分辨率、码率、帧率等配置）
    - 图像参数配置（色调、对比度、亮度、饱和度配置）
-  - [ ] 大华私有协议-设备网络SDK（开发中...）
+  - [X] 大华私有协议-设备网络SDK
+    - 局域网设备发现
+    - 设备主动注册（用于服务器部署在公网时设备的注册）
+    - 通道获取
+    - 预览
+    - 录像回放
+    - 录像下载
+    - 云台控制，支持预置位控制、巡航组、巡迹、水平旋转、云台速度配置、开机动作、空闲动作、云台限位、定时任务、云台重启
+    - 抓图（设备直接上传快照图片到服务器，流量消耗低，无需服务端拉流解码）
+    - 喊话（单工）和对讲（双工）
+    - 相机配置，包括亮度、对比度、对比度、饱和度、色彩抑制、伽马、锐度、锐度抑制；视角的配置，提供正常、倒影、走廊模式、镜像的配置；曝光、背光、白平衡、日夜模式、数字变倍、聚焦、补光灯、透雾的配置
+    - 报警接收
+  - [ ] 国标35114协议（开发中...）
  - [X] 国网B接口协议
    - 设备注册
    - 资源获取
--- a/src/main/java/com/genersoft/iot/vmp/gb28181/utils/SipUtils.java
+++ b/src/main/java/com/genersoft/iot/vmp/gb28181/utils/SipUtils.java
@ -205,6 +205,21 @@ public class SipUtils {
    }

    public static Gb28181Sdp parseSDP(String sdpStr) throws SdpParseException {
+        
+        // 校验：拦截空内容与注入攻击特征
+        if (sdpStr == null || sdpStr.trim().isEmpty()) {
+            throw new SdpParseException(0, 0, "SDP内容为空");
+        }
+        // 标准SDP每行格式固定为 "x=value"，不存在SQL关键字；出现则视为注入攻击
+        String sdpUpper = sdpStr.toUpperCase();
+        if (sdpUpper.contains("' OR '") || sdpUpper.contains("' OR 1") || sdpUpper.contains(" OR 1=1")
+                || sdpUpper.contains("--") || sdpUpper.contains("/*") || sdpUpper.contains("*/")
+                || sdpUpper.contains("DROP ") || sdpUpper.contains("INSERT ") || sdpUpper.contains("UPDATE ")
+                || sdpUpper.contains("DELETE ") || sdpUpper.contains("UNION ") || sdpUpper.contains("SELECT ")) {
+            log.error("[SDP注入攻击] 检测到非法SDP内容，已拒绝解析，内容长度: {}", sdpStr.length());
+            throw new SdpParseException(0, 0, "非法SDP内容");
+        }
+        //校验结束

        // jainSip不支持y= f=字段， 移除以解析。
        int ssrcIndex = sdpStr.indexOf("y=");
--- a/src/main/java/com/genersoft/iot/vmp/service/impl/MediaServiceImpl.java
+++ b/src/main/java/com/genersoft/iot/vmp/service/impl/MediaServiceImpl.java
@ -109,6 +109,7 @@ public class MediaServiceImpl implements IMediaService {
                // 鉴权通过
                redisCatchStorage.updateStreamAuthorityInfo(app, stream, streamAuthorityInfo);
            }
+            result.setEnable_audio(true);
            result.setEnable_mp4(userSetting.getRecordPushLive());
            return result;
        }
--- a/数据库/2.7.4/更新-mysql-2.7.4.sql
+++ b/数据库/2.7.4/更新-mysql-2.7.4.sql
@ -45,9 +45,9 @@ BEGIN
        ALTER TABLE wvp_media_server ADD jtt_proxy_port  integer;
    END IF;
 END; //
+DELIMITER ;
 call wvp_20250708();
 DROP PROCEDURE wvp_20250708;
-DELIMITER ;

 /*
 * 20250917
@ -67,9 +67,9 @@ BEGIN
        ALTER TABLE wvp_media_server ADD mp4_ssl_port integer;
    END IF;
 END; //
+DELIMITER ;
 call wvp_20250917();
 DROP PROCEDURE wvp_20250917;
-DELIMITER ;

 /*
 * 20250924
@ -95,9 +95,9 @@ BEGIN
        ALTER TABLE wvp_common_group ADD alias varchar(255) default null;
    END IF;
 END; //
+DELIMITER ;
 call wvp_20250924();
 DROP PROCEDURE wvp_20250924;
-DELIMITER ;


 /*
@ -112,11 +112,27 @@ BEGIN
        ALTER TABLE wvp_stream_proxy DROP enable_remove_none_reader;
    END IF;
 END; //
+DELIMITER ;
 call wvp_20251027();
 DROP PROCEDURE wvp_20251027;
-DELIMITER ;

-drop index uk_media_server_unique_ip_http_port on wvp_media_server;
+/*
+* 20251101
+*/
+DELIMITER //  -- 重定义分隔符避免分号冲突
+CREATE PROCEDURE `wvp_20251101`()
+BEGIN
+    IF EXISTS (SELECT 1 FROM information_schema.STATISTICS
+               WHERE TABLE_SCHEMA = (SELECT DATABASE())
+                 AND TABLE_NAME = 'wvp_media_server'
+                 AND INDEX_NAME = 'uk_media_server_unique_ip_http_port')
+    THEN
+        drop index uk_media_server_unique_ip_http_port on wvp_media_server;
+    END IF;
+END; //
+DELIMITER ;
+call wvp_20251101();
+DROP PROCEDURE wvp_20251101;

 /*
 * 202601025
@ -135,9 +151,9 @@ BEGIN
        ALTER TABLE wvp_device DROP keepalive_time;
    END IF;
 END; //
+DELIMITER ;
 call wvp_202601025();
 DROP PROCEDURE wvp_202601025;
-DELIMITER ;

 create table IF NOT EXISTS wvp_alarm (
    id serial primary key COMMENT '主键ID',
@ -192,9 +208,9 @@ ALTER TABLE wvp_device_mobile_position RENAME TO wvp_mobile_position;
 END IF;

 END; //
+DELIMITER ;
 call wvp_20260417();
 DROP PROCEDURE wvp_20260417;
-DELIMITER ;

 /*
 * 20260521 添加wvp_device_channel唯一约束，防止通道重复写入
Author	SHA1	Message	Date
阿斌	ebea781c35	Pre Merge pull request !46 from 阿斌/N/A	2026-06-09 08:48:05 +00:00
lin	6296ffd871	更新README	2026-06-09 16:47:41 +08:00
lin	782f226adf	提升数据库更新脚本兼容性，修复推流视频音频BUG	2026-06-08 16:23:41 +08:00
阿斌	c011389c3f	SDP 注入攻击 / 非法 SDP 协议数据 java.text.ParseException: [C@2f1fec26 ID expected at gov.nist.core.LexerCore.match(LexerCore.java:229) at gov.nist.javax.sdp.parser.OriginFieldParser.originField(OriginFieldParser.java:90) at gov.nist.javax.sdp.parser.OriginFieldParser.parse(OriginFieldParser.java:108) at gov.nist.javax.sdp.parser.SDPAnnounceParser.parse(SDPAnnounceParser.java:113) at javax.sdp.SdpFactory.createSessionDescription(SdpFactory.java:129) at com.genersoft.iot.vmp.gb28181.utils.SipUtils.parseSDP(SipUtils.java:229) at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.decode(InviteRequestProcessor.java:275) at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.process(InviteRequestProcessor.java:125) at com.genersoft.iot.vmp.gb28181.transmit.SIPProcessorObserver.processRequest(SIPProcessorObserver.java:71) at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103) at java.base/java.lang.reflect.Method.invoke(Method.java:580) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:196) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163) at org.springframework.aop.interceptor.AsyncExecutionInterceptor.lambda$invoke$0(AsyncExecutionInterceptor.java:114) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) at java.base/java.lang.Thread.run(Thread.java:1583) java.text.ParseException: o=- ' OR 'a'='a'; -- 1 IN IP4 179.43.150.26 at gov.nist.javax.sdp.parser.OriginFieldParser.originField(OriginFieldParser.java:103) at gov.nist.javax.sdp.parser.OriginFieldParser.parse(OriginFieldParser.java:108) at gov.nist.javax.sdp.parser.SDPAnnounceParser.parse(SDPAnnounceParser.java:113) at javax.sdp.SdpFactory.createSessionDescription(SdpFactory.java:129) at com.genersoft.iot.vmp.gb28181.utils.SipUtils.parseSDP(SipUtils.java:229) at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.decode(InviteRequestProcessor.java:275) at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.process(InviteRequestProcessor.java:125) at com.genersoft.iot.vmp.gb28181.transmit.SIPProcessorObserver.processRequest(SIPProcessorObserver.java:71) at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103) at java.base/java.lang.reflect.Method.invoke(Method.java:580) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:196) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163) at org.springframework.aop.interceptor.AsyncExecutionInterceptor.lambda$invoke$0(AsyncExecutionInterceptor.java:114) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) at java.base/java.lang.Thread.run(Thread.java:1583) Signed-off-by: 阿斌 <38912748@qq.com>	2026-03-21 16:15:47 +00:00