Pre Merge pull request !46 from 阿斌/N/A

java.text.ParseException: [C@2f1fec26
ID expected
        at gov.nist.core.LexerCore.match(LexerCore.java:229)
        at gov.nist.javax.sdp.parser.OriginFieldParser.originField(OriginFieldParser.java:90)
        at gov.nist.javax.sdp.parser.OriginFieldParser.parse(OriginFieldParser.java:108)
        at gov.nist.javax.sdp.parser.SDPAnnounceParser.parse(SDPAnnounceParser.java:113)
        at javax.sdp.SdpFactory.createSessionDescription(SdpFactory.java:129)
        at com.genersoft.iot.vmp.gb28181.utils.SipUtils.parseSDP(SipUtils.java:229)
        at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.decode(InviteRequestProcessor.java:275)
        at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.process(InviteRequestProcessor.java:125)
        at com.genersoft.iot.vmp.gb28181.transmit.SIPProcessorObserver.processRequest(SIPProcessorObserver.java:71)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:196)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
        at org.springframework.aop.interceptor.AsyncExecutionInterceptor.lambda$invoke$0(AsyncExecutionInterceptor.java:114)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
        at java.base/java.lang.Thread.run(Thread.java:1583)
java.text.ParseException: o=- ' OR 'a'='a'; -- 1 IN IP4 179.43.150.26
        at gov.nist.javax.sdp.parser.OriginFieldParser.originField(OriginFieldParser.java:103)
        at gov.nist.javax.sdp.parser.OriginFieldParser.parse(OriginFieldParser.java:108)
        at gov.nist.javax.sdp.parser.SDPAnnounceParser.parse(SDPAnnounceParser.java:113)
        at javax.sdp.SdpFactory.createSessionDescription(SdpFactory.java:129)
        at com.genersoft.iot.vmp.gb28181.utils.SipUtils.parseSDP(SipUtils.java:229)
        at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.decode(InviteRequestProcessor.java:275)
        at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.process(InviteRequestProcessor.java:125)
        at com.genersoft.iot.vmp.gb28181.transmit.SIPProcessorObserver.processRequest(SIPProcessorObserver.java:71)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:196)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
        at org.springframework.aop.interceptor.AsyncExecutionInterceptor.lambda$invoke$0(AsyncExecutionInterceptor.java:114)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
        at java.base/java.lang.Thread.run(Thread.java:1583)


Signed-off-by: 阿斌 <38912748@qq.com>

src/main/java/com/genersoft/iot/vmp/gb28181/utils/SipUtils.java

@@ -205,6 +205,21 @@ public class SipUtils {
     }
 
     public static Gb28181Sdp parseSDP(String sdpStr) throws SdpParseException {
+        
+        // 校验：拦截空内容与注入攻击特征
+        if (sdpStr == null || sdpStr.trim().isEmpty()) {
+            throw new SdpParseException(0, 0, "SDP内容为空");
+        }
+        // 标准SDP每行格式固定为 "x=value"，不存在SQL关键字；出现则视为注入攻击
+        String sdpUpper = sdpStr.toUpperCase();
+        if (sdpUpper.contains("' OR '") || sdpUpper.contains("' OR 1") || sdpUpper.contains(" OR 1=1")
+                || sdpUpper.contains("--") || sdpUpper.contains("/*") || sdpUpper.contains("*/")
+                || sdpUpper.contains("DROP ") || sdpUpper.contains("INSERT ") || sdpUpper.contains("UPDATE ")
+                || sdpUpper.contains("DELETE ") || sdpUpper.contains("UNION ") || sdpUpper.contains("SELECT ")) {
+            log.error("[SDP注入攻击] 检测到非法SDP内容，已拒绝解析，内容长度: {}", sdpStr.length());
+            throw new SdpParseException(0, 0, "非法SDP内容");
+        }
+        //校验结束
 
         // jainSip不支持y= f=字段， 移除以解析。
         int ssrcIndex = sdpStr.indexOf("y=");

src/main/java/com/genersoft/iot/vmp/jt1078/config/JT1078Config.java

@@ -1,6 +1,5 @@
 package com.genersoft.iot.vmp.jt1078.config;
 
-import com.genersoft.iot.vmp.jt1078.bean.common.ConfigAttribute;
 import lombok.Data;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.core.annotation.Order;
@@ -19,7 +18,8 @@ public class JT1078Config {
     private Boolean record = false;
 
     /**
-     * IdleStateHandler reader idle timeout, unit: minutes
+     * IDLE状态超时时间，单位：秒，默认0表示不启用，启用后当连接进入IDLE状态超过该时间时将被断开连接
+       连接进入IDLE状态的条件是：在readerIdleTime时间内没有收到任何数据包，并且在writerIdleTime时间内没有发送任何数据包
      */
-    private Integer readerIdleTime = 15;
+    private Integer readerIdleTime = 0;
 }

web/src/views/common/jessibuca.vue

@@ -273,6 +273,11 @@ export default {
     },
     setPlaybackRate: function() {
 
+    },
+    resize(width, height) {
+      if (jessibucaPlayer[this._uid]) {
+        jessibucaPlayer[this._uid].resize()
+      }
     }
   }
 }

web/src/views/device/channel/record.vue

@@ -50,7 +50,10 @@
         </div>
       </div>
       <div id="playerBox" style="width: 100%;">
-        <div class="playBox" style="height: calc(100vh - 220px); width: 100%; background-color: #000000">
+        <div :class="{
+          'play-box': true,
+          'play-box-fullscreen': isFullScreen,
+        }">
           <div
             v-if="playLoading"
             style="position: relative; left: calc(50% - 32px); top: 43%; z-index: 100;color: #fff;float: left; text-align: center;"
@@ -88,8 +91,13 @@
             @playTimeChange="showPlayTimeChange"
           />
         </div>
-        <div class="player-option-box">
+        <div :class="{
+          'player-option-box': true,
+          'player-option-box-bottom': isFullScreen
+        }">
+          <div v-if="showTime" class="time-line-show">{{ showTimeValue }}</div>
           <VideoTimeline
+            style="height: 55px"
             ref="Timeline"
             :init-time="initTime"
             :time-segments="timeSegments"
@@ -98,135 +106,134 @@
             @mousedown="timelineMouseDown"
             @mouseup="mouseupTimeline"
           />
-          <div v-if="showTime" class="time-line-show">{{ showTimeValue }}</div>
-        </div>
-        <div style="height: 40px; background-color: #383838; display: grid; grid-template-columns: 1fr 400px 1fr">
-          <div style="text-align: left;">
-            <div class="record-play-control" style="background-color: transparent; box-shadow: 0 0 10px transparent">
-              <a
-                target="_blank"
-                class="record-play-control-item iconfont icon-list"
-                title="列表"
-                @click="sidebarControl()"
-              />
-              <a
-                target="_blank"
-                class="record-play-control-item iconfont icon-camera1196054easyiconnet"
-                title="截图"
-                @click="snap()"
-              />
-              <a
-                target="_blank"
-                class="record-play-control-item iconfont icon-xiazai1"
-                title="下载录像"
-                @click="chooseTimeForRecord()"
-              />
-              <!--              <a target="_blank" class="record-play-control-item iconfont icon-xiazai011" title="下载" @click="gbPause()" />-->
-            </div>
-          </div>
-          <div style="text-align: center;">
-            <div class="record-play-control">
-              <a
-                v-if="chooseFileIndex > 0"
-                target="_blank"
-                class="record-play-control-item iconfont icon-diyigeshipin"
-                title="上一个"
-                @click="playLast()"
-              />
-              <a
-                v-else
-                style="color: #acacac; cursor: not-allowed"
-                target="_blank"
-                class="record-play-control-item iconfont icon-diyigeshipin"
-                title="上一个"
-              />
-              <a
-                target="_blank"
-                class="record-play-control-item iconfont icon-kuaijin"
-                title="快退五秒"
-                @click="seekBackward()"
-              />
-              <a
-                target="_blank"
-                class="record-play-control-item iconfont icon-stop1"
-                style="font-size: 14px"
-                title="停止"
-                @click="stopPLay()"
-              />
-              <a
-                v-if="playing"
-                target="_blank"
-                class="record-play-control-item iconfont icon-zanting"
-                title="暂停"
-                @click="pausePlay()"
-              />
-              <a v-if="!playing" target="_blank" class="record-play-control-item iconfont icon-kaishi" title="播放" @click="play()" />
-              <a
-                target="_blank"
-                class="record-play-control-item iconfont icon-houtui"
-                title="快进五秒"
-                @click="seekForward()"
-              />
-              <a
-                v-if="chooseFileIndex < detailFiles.length - 1"
-                target="_blank"
-                class="record-play-control-item iconfont icon-zuihouyigeshipin"
-                title="下一个"
-                @click="playNext()"
-              />
-              <a
-                v-else
-                style="color: #acacac; cursor: not-allowed"
-                target="_blank"
-                class="record-play-control-item iconfont icon-zuihouyigeshipin"
-                title="下一个"
-                @click="playNext()"
-              />
-              <el-dropdown @command="changePlaySpeed">
+          <div style="height: 40px; background-color: #383838; display: grid; grid-template-columns: 1fr 400px 1fr">
+            <div style="text-align: left;">
+              <div class="record-play-control" style="background-color: transparent; box-shadow: 0 0 10px transparent">
                 <a
                   target="_blank"
-                  class="record-play-control-item record-play-control-speed"
-                  title="倍速播放"
-                >{{ playSpeed }}X</a>
-                <el-dropdown-menu slot="dropdown">
-                  <el-dropdown-item
-                    v-for="item in playSpeedRange"
-                    :key="item"
-                    :command="item"
-                  >{{ item }}X
-                  </el-dropdown-item>
-                </el-dropdown-menu>
-              </el-dropdown>
-            </div>
-          </div>
-          <div style="text-align: right;">
-            <div class="record-play-control" style="background-color: transparent; box-shadow: 0 0 10px transparent">
-              <el-dropdown @command="changePlayer">
+                  class="record-play-control-item iconfont icon-list"
+                  title="列表"
+                  @click="sidebarControl()"
+                />
                 <a
                   target="_blank"
-                  class="record-play-control-item record-play-control-speed"
-                  title="切换播放器"
-                >{{ playerLabel }}</a>
-                <el-dropdown-menu slot="dropdown">
-                  <el-dropdown-item command="jessibuca">Jessibuca</el-dropdown-item>
-                  <el-dropdown-item command="webRTC">WebRTC</el-dropdown-item>
-                  <el-dropdown-item command="h265web">H265Web</el-dropdown-item>
-                </el-dropdown-menu>
-              </el-dropdown>
-              <a
-                v-if="!isFullScreen"
-                target="_blank"
-                class="record-play-control-item iconfont icon-fangdazhanshi"
-                title="全屏"
-                @click="fullScreen()"
-              />
-              <a
-                v-else
-                target="_blank"
-                class="record-play-control-item iconfont icon-suoxiao1"
-                title="全屏"
-                @click="fullScreen()"
-              />
+                  class="record-play-control-item iconfont icon-camera1196054easyiconnet"
+                  title="截图"
+                  @click="snap()"
+                />
+                <a
+                  target="_blank"
+                  class="record-play-control-item iconfont icon-xiazai1"
+                  title="下载录像"
+                  @click="chooseTimeForRecord()"
+                />
+                <!--              <a target="_blank" class="record-play-control-item iconfont icon-xiazai011" title="下载" @click="gbPause()" />-->
+              </div>
+            </div>
+            <div style="text-align: center;">
+              <div class="record-play-control">
+                <a
+                  v-if="chooseFileIndex > 0"
+                  target="_blank"
+                  class="record-play-control-item iconfont icon-diyigeshipin"
+                  title="上一个"
+                  @click="playLast()"
+                />
+                <a
+                  v-else
+                  style="color: #acacac; cursor: not-allowed"
+                  target="_blank"
+                  class="record-play-control-item iconfont icon-diyigeshipin"
+                  title="上一个"
+                />
+                <a
+                  target="_blank"
+                  class="record-play-control-item iconfont icon-kuaijin"
+                  title="快退五秒"
+                  @click="seekBackward()"
+                />
+                <a
+                  target="_blank"
+                  class="record-play-control-item iconfont icon-stop1"
+                  style="font-size: 14px"
+                  title="停止"
+                  @click="stopPLay()"
+                />
+                <a
+                  v-if="playing"
+                  target="_blank"
+                  class="record-play-control-item iconfont icon-zanting"
+                  title="暂停"
+                  @click="pausePlay()"
+                />
+                <a v-if="!playing" target="_blank" class="record-play-control-item iconfont icon-kaishi" title="播放" @click="play()" />
+                <a
+                  target="_blank"
+                  class="record-play-control-item iconfont icon-houtui"
+                  title="快进五秒"
+                  @click="seekForward()"
+                />
+                <a
+                  v-if="chooseFileIndex < detailFiles.length - 1"
+                  target="_blank"
+                  class="record-play-control-item iconfont icon-zuihouyigeshipin"
+                  title="下一个"
+                  @click="playNext()"
+                />
+                <a
+                  v-else
+                  style="color: #acacac; cursor: not-allowed"
+                  target="_blank"
+                  class="record-play-control-item iconfont icon-zuihouyigeshipin"
+                  title="下一个"
+                  @click="playNext()"
+                />
+                <el-dropdown @command="changePlaySpeed" placement="top">
+                  <a
+                    target="_blank"
+                    class="record-play-control-item record-play-control-speed"
+                    title="倍速播放"
+                  >{{ playSpeed }}X</a>
+                  <el-dropdown-menu slot="dropdown" :append-to-body="false">
+                    <el-dropdown-item
+                      v-for="item in playSpeedRange"
+                      :key="item"
+                      :command="item"
+                    >{{ item }}X
+                    </el-dropdown-item>
+                  </el-dropdown-menu>
+                </el-dropdown>
+              </div>
+            </div>
+            <div style="text-align: right;">
+              <div class="record-play-control" style="background-color: transparent; box-shadow: 0 0 10px transparent">
+                <el-dropdown @command="changePlayer" placement="top">
+                  <a
+                    target="_blank"
+                    class="record-play-control-item record-play-control-speed"
+                    title="切换播放器"
+                  >{{ playerLabel }}</a>
+                  <el-dropdown-menu slot="dropdown" :append-to-body="false">
+                    <el-dropdown-item command="jessibuca">Jessibuca</el-dropdown-item>
+                    <el-dropdown-item command="webRTC">WebRTC</el-dropdown-item>
+                    <el-dropdown-item command="h265web">H265Web</el-dropdown-item>
+                  </el-dropdown-menu>
+                </el-dropdown>
+                <a
+                  v-if="!isFullScreen"
+                  target="_blank"
+                  class="record-play-control-item iconfont icon-fangdazhanshi"
+                  title="全屏"
+                  @click="fullScreen()"
+                />
+                <a
+                  v-else
+                  target="_blank"
+                  class="record-play-control-item iconfont icon-suoxiao1"
+                  title="全屏"
+                  @click="fullScreen()"
+                />
+              </div>
             </div>
           </div>
         </div>
@@ -444,8 +451,10 @@ export default {
       const playerHeight = this.$refs.recordVideoPlayer.playerHeight
       screenfull.request(document.getElementById('playerBox'))
       screenfull.on('change', (event) => {
-        this.$refs.recordVideoPlayer.resize(playerWidth, playerHeight)
         this.isFullScreen = screenfull.isFullscreen
+        if (this.$refs.recordVideoPlayer && this.$refs.recordVideoPlayer.resize) {
+          this.$refs.recordVideoPlayer.resize(playerWidth, playerHeight)
+        }
       })
       this.isFullScreen = true
     },
@@ -674,14 +683,31 @@ export default {
 }
 
 .player-option-box {
-  height: 50px
+  height: 95px;
+}
+
+.player-option-box-bottom {
+  width: 100%;
+  position: absolute;
+  bottom: 0;
 }
 
 .time-line-show {
   position: relative;
   color: rgba(250, 249, 249, 0.89);
-  left: calc(50% - 85px);
-  top: -72px;
+  top: -24px;
+  height: 0;
+  width: stretch;
+  float: left;
+  text-align: center;
   text-shadow: 1px 0 #5f6b7c, -1px 0 #5f6b7c, 0 1px #5f6b7c, 0 -1px #5f6b7c, 1.1px 1.1px #5f6b7c, 1.1px -1.1px #5f6b7c, -1.1px 1.1px #5f6b7c, -1.1px -1.1px #5f6b7c;
 }
+.play-box {
+  width: 100%; aspect-ratio: 16 / 9;
+  background-color: #000000;
+  height: calc(100vh - 220px);
+}
+.play-box-fullscreen {
+  height: 100vh !important;
+}
 </style>