From 68d910e2292494f2b34247d6c6b74bb4bd036376 Mon Sep 17 00:00:00 2001
From: xiongziliang <771730766@qq.com>
Date: Mon, 25 May 2020 16:40:41 +0800
Subject: [PATCH] =?UTF-8?q?=E9=99=90=E5=88=B6rtsp/rtmp=E6=8E=A8=E6=B5=81ur?=
 =?UTF-8?q?l=E5=90=88=E6=B3=95=E6=80=A7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/Rtmp/RtmpSession.cpp | 6 ++++++
 src/Rtsp/RtspSession.cpp | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/src/Rtmp/RtmpSession.cpp b/src/Rtmp/RtmpSession.cpp
index c2e55863..d30eafaf 100644
--- a/src/Rtmp/RtmpSession.cpp
+++ b/src/Rtmp/RtmpSession.cpp
@@ -158,6 +158,12 @@ void RtmpSession::onCmd_publish(AMFDecoder &dec) {
         setSocketFlags();
     };
 
+    if(_mediaInfo._app.empty() || _mediaInfo._streamid.empty()){
+        //不允许莫名其妙的推流url
+        onRes("rtmp推流url非法", false, false, false);
+        return;
+    }
+
     Broadcast::PublishAuthInvoker invoker = [weakSelf,onRes,pToken](const string &err,bool enableRtxp,bool enableHls,bool enableMP4){
         auto strongSelf = weakSelf.lock();
         if(!strongSelf){
diff --git a/src/Rtsp/RtspSession.cpp b/src/Rtsp/RtspSession.cpp
index b2e8e088..c8f7e04e 100644
--- a/src/Rtsp/RtspSession.cpp
+++ b/src/Rtsp/RtspSession.cpp
@@ -240,6 +240,12 @@ void RtspSession::handleReq_ANNOUNCE(const Parser &parser) {
         _mediaInfo.parse(full_url);
     }
 
+    if(_mediaInfo._app.empty() || _mediaInfo._streamid.empty()){
+        //推流rtsp url必须最少两级(rtsp://host/app/stream_id)，不允许莫名其妙的推流url
+        sendRtspResponse("403 Forbidden", {"Content-Type", "text/plain"}, "rtsp推流url非法,最少确保两级rtsp url");
+        throw SockException(Err_shutdown,StrPrinter << "rtsp推流url非法:" << full_url);
+    }
+
     SdpParser sdpParser(parser.Content());
     _strSession = makeRandStr(12);
     _aTrackInfo = sdpParser.getAvailableTrack();