zijunchiang
669766ba60
现场事故（新设备 SM-S9180 / Android 16，WebView 正常 → 走 JS 取址）: 277 JS [KtvApi] URL OK: 7303235 ls=1 via http://w.w345.my 278 点歌编号=7303235 标题=情歌(HD) 请求源=http://w.w345.my 状态=成功 urlHost=gz.ac16.vip 279 PLAY id=7303235 title=情歌(HD) src=local 即 gz.ac16.vip 的广告视频被当成歌曲下载、缓存并播放。 三处漏洞叠加: 1. ktv_api.js 的 isDemoUrl 不认识广告域名；且"ts 文件名与编号比对"用的是 /\/(\d+)\.ts/，只匹配纯数字名 —— my_ad_video.ts 这类非数字名字直接放行； 2. SongOkDownloadManager.buildDownloadUrl 的**成功分支完全没有广告校验** （AdVideoFilter.isAdVideo 全项目只在"缓存地址"与"原生解析"两处被调用）； 3. SongApiClient.fetchFromDb 只做 isLikelyDemoUrl（纯 IP / r2.dev），挡不住广告域名。 且**内容校验挡不住广告**: 该广告通过 SongFileValidator（≥6MB/≥60s/TS 包完整）， 被 isDownloaded() 一直复用，广告会反复播。 修复（单一闸门，全链路把关）: - AdVideoFilter 新增 isTrustedSongUrl(url, musicno)：非 http(s)、命中广告特征 （路径 /ad_files/、my_ad_video、**域名 *.ac16.vip**）、或 URL 里 .ts 文件名不等于 点歌编号 → 一律不可信。真源恒为 /<musicno>.ts（已实测 txog.ktvsky.com 与 download.origjoy.com 两个 CDN 域共 6 首全部相符）。 - 该闸门接入全部出入口: JS isDemoUrl（同步加固 + KTV_BRIDGE_API 8→9）、 SongUrlResolver.isValidSongUrl、SongApiClient.fetchFromDb、 以及最终兜底 SongOkDownloadManager.buildDownloadUrl（成功/缓存两条分支）。 - 判定不可信时**同时删除已落盘的歌曲文件**（purgeCachedSongFile）， 否则 isDownloaded() 会一直复用那个广告文件。 - 新增 SongOkDownloadManager.purgeLegacySongCacheOnce(): 升级后一次性清理历史遗留的 可疑歌曲缓存（marker: filesDir/song_cache_purged_v1）。只是让歌曲重新下载，不动用户数据。 - 新增回归测试 AdVideoFilterTest（6 例，用日志里的真实 URL 形态，含两个真源 CDN 域）； 该测试当场抓到本修复自身的一个 bug：正则把扩展名也捕获进去导致真源被误杀，已修正。 版本 1.4.9(29) 到 1.4.10(30)；签名证书不变。
Maidong KTV
A local karaoke application for Android TV and landscape song-selection devices
Remote Control · Song Discovery · Request Queue · Download Management · Stable Playback
Core Features
- Full TV remote navigation with directional keys, confirmation, back, and long-press actions.
- Consistent focus feedback for buttons, lists, cards, switches, and dialogs.
- Home entries for charts, song titles, singers, frequently played songs, favorites, categories, and local songs.
- Online and local search with language filters, paging, and initial-letter keyboard input.
- Singer browsing with portrait tags and singer-specific song lists.
- Song ordering, batch ordering, queue prioritization, favorites, and file management.
- Real-time synchronization across queued, played, and downloaded song lists.
- New requests join the end of the queue without interrupting the current requested song.
- Automatic playback when requested songs are available, including smooth transitions from public playback.
Playback
- IJK-based playback for local and downloaded songs.
- Continuous playback while navigating between pages or switching between windowed and full-screen modes.
- Play, pause, skip, replay, progress display, and seeking controls.
- Original-vocal and accompaniment switching without changing the current play or pause state.
- Synchronized playback state across windowed controls, full-screen controls, and status overlays.
- Song title overlays, temporary mode prompts, and persistent pause indicators.
- Video ratio, automatic full screen, audio-video synchronization, and public playback settings.
- Maximum song volume and configurable original-vocal and accompaniment behavior.
Downloads And Data
- Background downloads with progress, resume support, and automatic retry.
- Automatic cleanup and retry after download or decryption failures.
- Recognition, counting, and playback of downloaded local songs.
- Segmented database download, verification, merge, and atomic update.
- Directory creation, database scanning, and download startup only after storage permission is granted.
- Local disk and USB song scanning, reserved storage settings, and automatic cleanup.
- Unified Maidong KTV data storage to avoid conflicts with other applications.
Settings
- Data settings for library updates, local scanning, reserved space, automatic cleanup, and database maintenance.
- Playback settings for public playback, automatic full screen, video ratio, synchronization, and title overlays.
- Sound settings for volume behavior, maximum song volume, original vocals, and accompaniment.
- Interface settings for language, floating controls, carousel content, and song title overlays.
- Dialog selections remain temporary until confirmed and provide clear remote-control focus feedback.
Interface And Interaction
- Landscape TV layout optimized for long-distance viewing.
- Consistent state and meaning across top, windowed, and full-screen playback controls.
- Stable focus during list refreshes, paging, tab changes, and song ordering.
- Focus changes color only and preserves each control's original dimensions, corners, and layout.
- A consistent circular Maidong logo across the home screen, player, and application information.
Project Notice
This repository: https://gitea.kasugano.cn/zijunchiang/maidong-ktv
UI/feature framework credit: https://gitee.com/yangyachao-X/maidong-ktv
This repository reworks the upstream "Maidong KTV" UI and feature framework, and the core/data layer was rewritten with DSH (DeepSeek Harness): library sync, song-source integration, device auth, risk-control handling, remote logging, and ad blocking are all new implementations.
Highlights of the reworked data layer:
- Library: synced exclusively from the official Muse service
(
mconn.cherryonline.cnmls-api/v1/sqlite/sync); the code host carries source only, no database files. - Song source:
w.w345.my(i.phptoken →do.phpplayback URL) with fixed device identity and reproduced signing; ad/mismatched resources (e.g.wb66.cn/.../719.ts) are blocked and retried. - JS hot-update:
app/src/main/assets/mobile/ktv_api.js, requires theKTV_BRIDGE_API: 7marker.
Building
Requirements: JDK 17, Android SDK (compileSdk 35, minSdk 21, targetSdk 25),
Gradle wrapper 8.13 (bundled).
cd maidong-ktv
export JAVA_HOME=/path/to/jdk-17
export ANDROID_HOME=/path/to/android-sdk
export ANDROID_SDK_ROOT=$ANDROID_HOME
./gradlew assembleRelease
The release signing config in app/build.gradle expects ../../ktv_keystore.jks (one level above the
repo root) with alias ktv / password 123456; adjust paths or use signingConfigs.debug for a
quick unsigned build. Output: app/build/outputs/apk/release/app-release.apk
(dual ABI: armeabi-v7a + arm64-v8a). Install with adb install -r <apk>.
For non-commercial learning purposes only. Respect upstream copyright and song licensing.