Pre Merge pull request !46 from 阿斌/N/A

Update 初始化-postgresql-kingbase-2.7.4.sql

src/main/java/com/genersoft/iot/vmp/gb28181/utils/SipUtils.java

@@ -204,6 +204,21 @@ public class SipUtils {
     }
 
     public static Gb28181Sdp parseSDP(String sdpStr) throws SdpParseException {
+        
+        // 校验：拦截空内容与注入攻击特征
+        if (sdpStr == null || sdpStr.trim().isEmpty()) {
+            throw new SdpParseException(0, 0, "SDP内容为空");
+        }
+        // 标准SDP每行格式固定为 "x=value"，不存在SQL关键字；出现则视为注入攻击
+        String sdpUpper = sdpStr.toUpperCase();
+        if (sdpUpper.contains("' OR '") || sdpUpper.contains("' OR 1") || sdpUpper.contains(" OR 1=1")
+                || sdpUpper.contains("--") || sdpUpper.contains("/*") || sdpUpper.contains("*/")
+                || sdpUpper.contains("DROP ") || sdpUpper.contains("INSERT ") || sdpUpper.contains("UPDATE ")
+                || sdpUpper.contains("DELETE ") || sdpUpper.contains("UNION ") || sdpUpper.contains("SELECT ")) {
+            log.error("[SDP注入攻击] 检测到非法SDP内容，已拒绝解析，内容长度: {}", sdpStr.length());
+            throw new SdpParseException(0, 0, "非法SDP内容");
+        }
+        //校验结束
 
         // jainSip不支持y= f=字段， 移除以解析。
         int ssrcIndex = sdpStr.indexOf("y=");

数据库/2.7.4/初始化-postgresql-kingbase-2.7.4.sql

@@ -350,7 +350,7 @@ create table IF NOT EXISTS wvp_media_server
     record_path         character varying(255),
     record_day          integer               default 7,
     transcode_suffix    character varying(255),
-    server_id           character varying(50),
+    server_id           character varying(50)
 );
 COMMENT ON TABLE wvp_media_server IS '媒体服务器（如 ZLM）节点信息';
 COMMENT ON COLUMN wvp_media_server.id IS '媒体服务器ID';
@@ -931,7 +931,7 @@ create table IF NOT EXISTS wvp_alarm (
         latitude double precision,
         alarm_type integer,
         alarm_time bigint
-)
+);
 COMMENT ON COLUMN wvp_alarm.id IS '主键ID';
 COMMENT ON COLUMN wvp_alarm.channel_id IS '关联通道的数据库id';
 COMMENT ON COLUMN wvp_alarm.description IS '报警描述';