Firstly thank you so much for the excellent Cling library for Android. I have been using Cling (currently 2.0.1) in my 'NAS Cast' Android app for about a year now, and have found it excellent to work with. Up until now I have managed to solve any DLNA issues I have had; however with this one I am completely stumped... It could still be me / my code, but I have worked hard to rule out as much as possible before asking for help.

With Twonky (7.2.8 running on Raspbrian Linux on a Raspberry Pi 2) when I browse my film folder containing 163 video files Cling DIDLContent.getItems().size() only returns 103 items. If I look at ActionInvocation.getOutput()[2] I see 163 (the expected number). Also calling getChildCount() on the parent container returns 163 (as expected). It seems as though didl is not fully hydrated when the received() callback is called? <- Is this the case / due to the Android Optimisation?

This works fine on Cling Workbench (on Windows), so I tried changing all combinations of XML parsers, but it made no difference, so this is either something unique to Cling on Android, or my code.

I am running on Android 5.1.1 on a Nexus 5, but from my google analytics it looks like that is not relent. Other media servers seem to work fine, looks like just Twonky (multiple versions).

Really hopeful that someone can point me in the right direction. Thank you very much for your help.

Service<?, ?> service = mCurrentServer.findService(new UDAServiceType("ContentDirectory"));
        if(service != null) {
            mUpnpService.getControlPoint().execute(
                    new Browse(
                            service,
                            mCurrentPath.peek(),
                            BrowseFlag.DIRECT_CHILDREN
                    ) {

                        @Override
                        public void received(ActionInvocation actionInvocation, final DIDLContent didl) {
                              // didl.getItems().size() returns 103, expecting 163
                              // actionInvocation.getOutput()[2] is 163, the expected number
                              // The parent getChildCount() returns 163 as expected

UPnP Device Architecture allows different search targets for the ST header, but I can not find an option to specify a discovery using "ST:upnp:rootdevice". It seems, that only "ST:ssdp:all" is alowed.

Can anybody give me a hint ?

Best Hans-Jörg

Getting crash on `java.lang.RuntimeException: Fatal error while executing protocol 'SendingSearch': org.fourthline.cling.transport.RouterException: Router wasn't available exclusively after waiting 15000ms, lock failed: ReadLock

1 | at org.fourthline.cling.protocol.SendingAsync.run(SendingAsync.java:61) 2 | at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1133) 3 | at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:607) 4 | at java.lang.Thread.run(Thread.java:762) 5 | Caused by: org.fourthline.cling.transport.RouterException: Router wasn't available exclusively after waiting 15000ms, lock failed: ReadLock 6 | at org.fourthline.cling.transport.RouterImpl.lock(RouterImpl.java:499) 7 | at org.fourthline.cling.transport.RouterImpl.lock(RouterImpl.java:510) 8 | at org.fourthline.cling.transport.RouterImpl.send(RouterImpl.java:305) 9 | at org.fourthline.cling.protocol.async.SendingSearch.execute(SendingSearch.java:91) 10 | at org.fourthline.cling.protocol.SendingAsync.run(SendingAsync.java:54) 11 | at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1133) 12 | at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:607) 13 | at java.lang.Thread.run(Thread.java:762)

0 | at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1068) 1 | at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1063)

0 | at android.os.MessageQueue.nativePollOnce(Native Method) 1 | at android.os.MessageQueue.next(MessageQueue.java:323) 2 | at android.os.Looper.loop(Looper.java:136) 3 | at android.app.ActivityThread.main(ActivityThread.java:6688) 4 | at java.lang.reflect.Method.invoke(Native Method) 5 | at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1468) 6 | at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1358) `

Please help us out, how we can get rid of this crash from "cling-core-2.1.2-SNAPSHOT.jar" library.

What specifically is required from Jetty for Cling? Cling is great but when it takes up 17% of the Android method dex limit, it makes a bit heavy weight.

3367     org.fourthline.cling
6886     org.eclipse
893      org.seamless
= 11,146 - 65,536 (dex limit)
=~ 17%

Are there possibilities to modulise the code? Or use a lighter weight network client?

Hi, everyone. I'm doing some jobs with cling libs. But when I use cling 2.0.1, I found that when I switch my TV set box from one to another wifi home network, it can't work normally. Originally, I used the cling 1.0.5 and it worked well. But I want to change the nofity period, so I change to use 2.0.1. But now I'm confused but I didn't change too much codes. If somebody knows how to solve it, give me a help. Thanks.

i checked in bubble upnp ,it works fine,when i try to play it is failing..it always shows 500 internal server error

      Play play= new Play(m_avtransportService) {
         @Override
        public void success(ActionInvocation invocation) {
            super.success(invocation);
            fireOnPlayingEvent();              
            Log.d(TAG,"Play is sucess");
        }


         @Override
        public void failure(ActionInvocation invocation, UpnpResponse response, String defaultMsg) {

             fireOnFailEvent(invocation.getAction(), response,
                    Play.class.getSimpleName() + ":" + defaultMsg);

            }

    };

    m_controlPoint.execute(play);

i was using cling 1 ,recently i migrated to cling 2.00

i am trying to play when the setUri is sucess,

this is my meta data dc:titleDeeyaalo Deeyaalo - TamilTunes.com/dc:titledc:creatorOranthanadu Gopu/dc:creatorupnp:classobject.item.audioItem.musicTrack/upnp:classupnp:albumKayal (2014)/upnp:album<upnp:artist role="Performer">Oranthanadu Gopu/upnp:artisthttp://192.168.43.121:57645/external/audio/media/230.mp3

I am currently working on a project, and I noticed that

org.fourthline.cling.support.avtransport.callback.Previous org.fourthline.cling.support.avtransport.callback.Next

exist in the source on github, and in the documentations, but they are not part of the latest downloadable release. I cannot say whether more classes are missing or not.

Could you update the jar files please?

Some variables documented in the spec are missing in class org.teleal.cling.support.avtransport.lastchange.AVTransportVariable, e.g. RelativeTimePosition and AbsoluteTimePosition. This makes it difficult to use the LastChangeParser to read these variables.

-environment: two or more SAME android devices Under Android 2.2

-target source: org.teleal.cling.model.types.UDN.java

public static UDN uniqueSystemIdentifier(String salt) { 

    java.net.InetAddress i = java.net.InetAddress.getLocalHost(); 
    systemSalt.append(i.getHostName()).append(i.getHostAddress()); 
    // Android always returns "localhost" and "127.0.0.1", not "192.168.0.xxx" 

-more details: http://mailinglists.945824.n3.nabble.com/Same-Android-Devices-Couldn-t-Discovery-Because-Same-UDN-Created-tp3808695p3808695.html

…ible and easy) up to 1.7 source compatability level. Add SuppressWarnings to all rawtype, unchecked, and unused elements in the Test Suites, and Implementation so the Eclipse project is clean.

Added Gradle Support and initial configuration files.

Work still to be done:

Need to figure out how to do this for the Android Demo Projects, as they use Android Specific resources, such as 'R.java' which is generally not included with Android Library compilation outside of Android Studio.

java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.Long org.teleal.cling.model.types.UnsignedIntegerFourBytes.getValue()' on a null object reference at org.teleal.cling.support.model.PositionInfo.(PositionInfo.java:44) at org.teleal.cling.support.avtransport.callback.GetPositionInfo.success(GetPositionInfo.java:46) at org.teleal.cling.controlpoint.ActionCallback.run(ActionCallback.java:156) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1112) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:587) at java.lang.Thread.run(Thread.java:818)

I have an issue where every time I try to play a video from my Android phone using via Upnp using the Media Monkey app, I keep getting the "server inaccessible" message and the video won't play. If I wait a few seconds and press play again, the video will start playing somehow but then it ends up crashing a few minutes later. I can't do any seeking (forward or backward) for that video either or it will freeze up and crash.

This is some of the logs

06:55:52 INFO Media renderer was not recognized. Possible identifying HTTP headers: User-Agent: Linux/4.4.84-229.kcl4tv.5 UPnP/1.0 LGE WebOS TV LGE_DLNA_SDK/1.6.0/03.33.11 DLNADOC/1.50 DLNADeviceName.lge.com: %5bLG%5d%20webOS%20TV%20OLED55C1PUB 06:55:54 INFO Media renderer was not recognized. Possible identifying HTTP headers: User-Agent: Linux/4.4.84-229.kcl4tv.5 UPnP/1.0 LGE WebOS TV LGE_DLNA_SDK/1.6.0/03.33.11 DLNADOC/1.50 DLNADeviceName.lge.com: %5bLG%5d%20webOS%20TV%20OLED55C1PUB

Hi,

We are developing a tool to check whether the dependencies' scopes in maven are set rightly and reasonably.

Our tools have found some issues in your project about scope setting in maven' pom.xml file.

• in core\pom.xml, javax.enterprise:cdi-api scope should be compile instead of provided.

Please help us confirm whether the following reports are right and explain why it should set like these.

Thanks a lot.

Hey there!

I belong to an open source security research community, and a member (@srikanthprathi) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

The Upnp protocol implemented in the latest version of cling has a flaw, and the CALLBACK parameter in the request header of the service's subscribe request is not checked, resulting in the attacker using this flaw to send malicious data to the device developed using cling, which causes the device to specify to the attacker. A large amount of data is sent from the IP address of the IP address to implement a DDOS attack; at the same time, the vulnerability can be used to implement an SSRF attack on the intranet. Payload is

SUBSCRIBE / HTTP/1.1
Host: localhost:9999
Accept-Encoding: identity
User-Agent: Callstranger Vulnerability Checker
CALLBACK: <Malicious address>
TIMEOUT: Second-300
NT: upnp:event
Content-Length: 0

• Want to take over the Java ecosystem? All you need is a MITM!
• Update: Want to take over the Java ecosystem? All you need is a MITM!

This is a security fix for a vulnerability in your Apache Maven pom.xml file(s).

The build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. This leaves your build vulnerable to allowing a Man in the Middle (MITM) attackers to execute arbitrary code on your or your computer or CI/CD system.

This vulnerability has a CVSS v3.0 Base Score of 8.1/10.

POC code has existed since 2014 to maliciously compromise a JAR file in-flight. MITM attacks against HTTP are increasingly common, for example Comcast is known to have done it to their own users.

This contribution is a part of a submission to the GitHub Security Lab Bug Bounty program.

Detecting this and Future Vulnerabilities

This vulnerability was automatically detected by LGTM.com using this CodeQL Query.

As of September 2019 LGTM.com and Semmle are officially a part of GitHub.

You can automatically detect future vulnerabilities like this by enabling the free (for open-source) LGTM App.

I'm not an employee of GitHub nor of Semmle, I'm simply a user of LGTM.com and an open-source security researcher.

Source

Yes, this contribution was automatically generated, however, the code to generate this PR was lovingly hand crafted to bring this security fix to your repository.

The source code that generated and submitted this PR can be found here: JLLeitschuh/bulk-security-pr-generator

Opting-Out

If you'd like to opt-out of future automated security vulnerability fixes like this, please consider adding a file called .github/GH-ROBOTS.txt to your repository with the line:

User-agent: JLLeitschuh/bulk-security-pr-generator
Disallow: *

This bot will respect the ROBOTS.txt format for future contributions.

Alternatively, if this project is no longer actively maintained, consider archiving the repository.

CLA Requirements

This section is only relevant if your project requires contributors to sign a Contributor License Agreement (CLA) for external contributions.

It is unlikely that I'll be able to directly sign CLAs. However, all contributed commits are already automatically signed-off.

The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin (see https://developercertificate.org/ for more information).

- Git Commit Signoff documentation

If signing your organization's CLA is a strict-requirement for merging this contribution, please feel free to close this PR.

Tracking

All PR's generated as part of this fix are tracked here: https://github.com/JLLeitschuh/bulk-security-pr-generator/issues/2