aunix/wvp-GB28181-pro
1
0
Fork 0
mirror of https://gitee.com/pan648540858/wvp-GB28181-pro.git synced 2026-05-06 14:07:49 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Compare commits

base: aunix:aeffac72b044eca2986f859e04e2416135cf2dad
Branches Tags
aunix:master
aunix:dev/压力测试
aunix:2.7.1
aunix:dev/springBoot3
aunix:dev/1400
aunix:2.7.3
aunix:dev/异常挂载数据处理
aunix:2.7.0
aunix:dev/多线程性能优化
aunix:2.7.1-t
aunix:2.7.2
aunix:2.7.1-多对一语音对讲
aunix:dev/abl支持
aunix:2.6.8
aunix:结构优化
aunix:2.6.9
aunix:wvp-28181-record
aunix:xinchuang
aunix:sip
aunix:2.6.4
aunix:2.6.7
aunix:2.6.6
aunix:2.6.5
aunix:wvp-dialog
aunix:2.6.3
aunix:ui-optimization
aunix:storage-sqlite
aunix:v1.0
...
compare: aunix:0830bf4289e9547a2859ded9b57ce7326c58f144
Branches Tags
aunix:master
aunix:dev/压力测试
aunix:2.7.1
aunix:dev/springBoot3
aunix:dev/1400
aunix:2.7.3
aunix:dev/异常挂载数据处理
aunix:2.7.0
aunix:dev/多线程性能优化
aunix:2.7.1-t
aunix:2.7.2
aunix:2.7.1-多对一语音对讲
aunix:dev/abl支持
aunix:2.6.8
aunix:结构优化
aunix:2.6.9
aunix:wvp-28181-record
aunix:xinchuang
aunix:sip
aunix:2.6.4
aunix:2.6.7
aunix:2.6.6
aunix:2.6.5
aunix:wvp-dialog
aunix:2.6.3
aunix:ui-optimization
aunix:storage-sqlite
aunix:v1.0

3 Commits
aeffac72b0 ... 0830bf4289

Author SHA1 Message Date
阿斌
0830bf4289
Pre Merge pull request !46 from 阿斌/N/A 2026-04-10 09:25:22 +00:00
lin
80d35b3231 确保语音对讲未携带SSRC时生成随机SSRC 2026-04-10 17:25:03 +08:00
阿斌
c011389c3f
SDP 注入攻击 / 非法 SDP 协议数据 
java.text.ParseException: [C@2f1fec26
ID expected
        at gov.nist.core.LexerCore.match(LexerCore.java:229)
        at gov.nist.javax.sdp.parser.OriginFieldParser.originField(OriginFieldParser.java:90)
        at gov.nist.javax.sdp.parser.OriginFieldParser.parse(OriginFieldParser.java:108)
        at gov.nist.javax.sdp.parser.SDPAnnounceParser.parse(SDPAnnounceParser.java:113)
        at javax.sdp.SdpFactory.createSessionDescription(SdpFactory.java:129)
        at com.genersoft.iot.vmp.gb28181.utils.SipUtils.parseSDP(SipUtils.java:229)
        at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.decode(InviteRequestProcessor.java:275)
        at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.process(InviteRequestProcessor.java:125)
        at com.genersoft.iot.vmp.gb28181.transmit.SIPProcessorObserver.processRequest(SIPProcessorObserver.java:71)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:196)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
        at org.springframework.aop.interceptor.AsyncExecutionInterceptor.lambda$invoke$0(AsyncExecutionInterceptor.java:114)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
        at java.base/java.lang.Thread.run(Thread.java:1583)
java.text.ParseException: o=- ' OR 'a'='a'; -- 1 IN IP4 179.43.150.26
        at gov.nist.javax.sdp.parser.OriginFieldParser.originField(OriginFieldParser.java:103)
        at gov.nist.javax.sdp.parser.OriginFieldParser.parse(OriginFieldParser.java:108)
        at gov.nist.javax.sdp.parser.SDPAnnounceParser.parse(SDPAnnounceParser.java:113)
        at javax.sdp.SdpFactory.createSessionDescription(SdpFactory.java:129)
        at com.genersoft.iot.vmp.gb28181.utils.SipUtils.parseSDP(SipUtils.java:229)
        at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.decode(InviteRequestProcessor.java:275)
        at com.genersoft.iot.vmp.gb28181.transmit.event.request.impl.InviteRequestProcessor.process(InviteRequestProcessor.java:125)
        at com.genersoft.iot.vmp.gb28181.transmit.SIPProcessorObserver.processRequest(SIPProcessorObserver.java:71)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:359)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:196)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
        at org.springframework.aop.interceptor.AsyncExecutionInterceptor.lambda$invoke$0(AsyncExecutionInterceptor.java:114)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
        at java.base/java.lang.Thread.run(Thread.java:1583)


Signed-off-by: 阿斌 <38912748@qq.com>
 2026-03-21 16:15:47 +00:00
2 changed files with 26 additions and 2 deletions
Show Stats Expand all files Collapse all files

13
src/main/java/com/genersoft/iot/vmp/gb28181/transmit/event/request/impl/InviteRequestProcessor.java
View File

@ -2,7 +2,6 @@ package com.genersoft.iot.vmp.gb28181.transmit.event.request.impl;
import com.genersoft.iot.vmp.common.InviteSessionType;
import com.genersoft.iot.vmp.common.VideoManagerConstants;
import com.genersoft.iot.vmp.common.enums.ChannelDataType;
import com.genersoft.iot.vmp.conf.DynamicTask;
import com.genersoft.iot.vmp.conf.SipConfig;
import com.genersoft.iot.vmp.conf.UserSetting;
@ -40,6 +39,7 @@ import javax.sip.RequestEvent;
import javax.sip.SipException;
import javax.sip.header.CallIdHeader;
import javax.sip.message.Response;
import java.security.SecureRandom;
import java.text.ParseException;
import java.util.List;
import java.util.Vector;
@ -481,6 +481,13 @@ public class InviteRequestProcessor extends SIPRequestProcessorParent implements
try {
Gb28181Sdp gb28181Sdp = SipUtils.parseSDP(contentString);
SessionDescription sdp = gb28181Sdp.getBaseSdb();
if (ObjectUtils.isEmpty(gb28181Sdp.getSsrc()) ) {
String ssrc = Integer.toUnsignedString(new SecureRandom().nextInt());
log.warn("来自设备的Invite请求，未携带SSRC，生成随机ssrc: {}，requesterId： {}/{}", ssrc, inviteInfo.getRequesterId(), inviteInfo.getSourceChannelId());
gb28181Sdp.setSsrc(ssrc);
}
// 获取支持的格式
Vector mediaDescriptions = sdp.getMediaDescriptions(true);
@ -622,7 +629,9 @@ public class InviteRequestProcessor extends SIPRequestProcessorParent implements
content.append("a=setup:passive\r\n");
}
}
content.append("y=" + ssrc + "\r\n");
if (ssrc != null) {
content.append("y=" + ssrc + "\r\n");
}
content.append("f=v/////a/1/8/1\r\n");
Platform parentPlatform = new Platform();

15
src/main/java/com/genersoft/iot/vmp/gb28181/utils/SipUtils.java
View File

@ -204,6 +204,21 @@ public class SipUtils {
}
public static Gb28181Sdp parseSDP(String sdpStr) throws SdpParseException {
// 校验：拦截空内容与注入攻击特征
if (sdpStr == null || sdpStr.trim().isEmpty()) {
throw new SdpParseException(0, 0, "SDP内容为空");
}
// 标准SDP每行格式固定为 "x=value"，不存在SQL关键字；出现则视为注入攻击
String sdpUpper = sdpStr.toUpperCase();
if (sdpUpper.contains("' OR '") || sdpUpper.contains("' OR 1") || sdpUpper.contains(" OR 1=1")
|| sdpUpper.contains("--") || sdpUpper.contains("/*") || sdpUpper.contains("*/")
|| sdpUpper.contains("DROP ") || sdpUpper.contains("INSERT ") || sdpUpper.contains("UPDATE ")
|| sdpUpper.contains("DELETE ") || sdpUpper.contains("UNION ") || sdpUpper.contains("SELECT ")) {
log.error("[SDP注入攻击] 检测到非法SDP内容，已拒绝解析，内容长度: {}", sdpStr.length());
throw new SdpParseException(0, 0, "非法SDP内容");
}
//校验结束
// jainSip不支持y= f=字段， 移除以解析。
int ssrcIndex = sdpStr.indexOf("y=");