From 1812274feb03819c8300fdf4fc25075e361cd001 Mon Sep 17 00:00:00 2001 From: bigtea Date: Mon, 9 Dec 2024 18:04:42 +0800 Subject: [PATCH] Add VerifyAccessTokenList Signed-off-by: bigtea --- .../accesstoken_service_ipc_interface_code.h | 2 + .../include/i_accesstoken_manager.h | 2 + .../accesstoken/include/accesstoken_kit.h | 12 ++- .../accesstoken/libaccesstoken_sdk.map | 1 + .../accesstoken/src/accesstoken_kit.cpp | 44 +++++++++ .../src/accesstoken_manager_client.cpp | 11 +++ .../src/accesstoken_manager_client.h | 2 + .../src/accesstoken_manager_proxy.cpp | 30 ++++++ .../src/accesstoken_manager_proxy.h | 2 + .../accesstoken_kit_test.cpp | 19 ++++ .../unittest/src/accesstoken_kit_test.cpp | 91 +++++++++++++++++++ .../service/accesstoken_manager_service.h | 2 + .../service/accesstoken_manager_stub.h | 1 + .../service/accesstoken_manager_service.cpp | 11 +++ .../src/service/accesstoken_manager_stub.cpp | 16 ++++ test/fuzztest/innerkits/accesstoken/BUILD.gn | 1 + .../verifyaccesstokenwithlist_fuzzer/BUILD.gn | 43 +++++++++ .../corpus/init | 14 +++ .../project.xml | 25 +++++ .../verifyaccesstokenwithlist_fuzzer.cpp | 58 ++++++++++++ .../verifyaccesstokenwithlist_fuzzer.h | 21 +++++ test/fuzztest/services/accesstoken/BUILD.gn | 1 + .../BUILD.gn | 47 ++++++++++ .../corpus/init | 14 +++ .../project.xml | 25 +++++ .../verifyaccesstokenwithliststub_fuzzer.cpp | 67 ++++++++++++++ .../verifyaccesstokenwithliststub_fuzzer.h | 21 +++++ 27 files changed, 582 insertions(+), 1 deletion(-) create mode 100644 test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/BUILD.gn create mode 100644 test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/corpus/init create mode 100644 test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/project.xml create mode 100644 test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/verifyaccesstokenwithlist_fuzzer.cpp create mode 100644 test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/verifyaccesstokenwithlist_fuzzer.h create mode 100644 test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/BUILD.gn create mode 100644 test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/corpus/init create mode 100644 test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/project.xml create mode 100644 test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/verifyaccesstokenwithliststub_fuzzer.cpp create mode 100644 test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/verifyaccesstokenwithliststub_fuzzer.h diff --git a/frameworks/accesstoken/include/accesstoken_service_ipc_interface_code.h b/frameworks/accesstoken/include/accesstoken_service_ipc_interface_code.h index 3f15f41fd..bdee59d9a 100644 --- a/frameworks/accesstoken/include/accesstoken_service_ipc_interface_code.h +++ b/frameworks/accesstoken/include/accesstoken_service_ipc_interface_code.h @@ -71,6 +71,8 @@ enum class AccessTokenInterfaceCode { UPDATE_USER_POLICY, CLEAR_USER_POLICY, GET_HAP_TOKENINFO_EXT, + + VERIFY_ACCESSTOKEN_WITH_LIST = 0x0050, }; } // namespace AccessToken } // namespace Security diff --git a/frameworks/accesstoken/include/i_accesstoken_manager.h b/frameworks/accesstoken/include/i_accesstoken_manager.h index 0a49f90f3..ac5a4f2a9 100644 --- a/frameworks/accesstoken/include/i_accesstoken_manager.h +++ b/frameworks/accesstoken/include/i_accesstoken_manager.h @@ -49,6 +49,8 @@ public: virtual PermUsedTypeEnum GetPermissionUsedType( AccessTokenID tokenID, const std::string& permissionName) = 0; virtual int VerifyAccessToken(AccessTokenID tokenID, const std::string& permissionName) = 0; + virtual int VerifyAccessToken(AccessTokenID tokenID, + const std::vector& permissionList, std::vector& permStateList) = 0; virtual int GetDefPermission(const std::string& permissionName, PermissionDefParcel& permissionDefResult) = 0; virtual int GetDefPermissions(AccessTokenID tokenID, std::vector& permList) = 0; virtual int GetReqPermissions( diff --git a/interfaces/innerkits/accesstoken/include/accesstoken_kit.h b/interfaces/innerkits/accesstoken/include/accesstoken_kit.h index 0442d19bf..87cb876a2 100644 --- a/interfaces/innerkits/accesstoken/include/accesstoken_kit.h +++ b/interfaces/innerkits/accesstoken/include/accesstoken_kit.h @@ -192,7 +192,7 @@ public: */ static int VerifyAccessToken( AccessTokenID callerTokenID, AccessTokenID firstTokenID, const std::string& permissionName); - /** + /** * @brief Check if the input tokenID has been granted the input permission. * @param tokenID token id * @param permissionName permission to be checked @@ -210,6 +210,16 @@ public: */ static int VerifyAccessToken(AccessTokenID callerTokenID, AccessTokenID firstTokenID, const std::string& permissionName, bool crossIpc); + /** + * @brief Check if the input tokenID has been granted the input permission list. + * @param tokenID token id + * @param permissionList permission list to be checked + * @param permStateList enum PermissionState list, as result + * @param crossIpc whether to cross ipc + * @return error code, see access_token_error.h + */ + static int VerifyAccessToken(AccessTokenID tokenID, const std::vector& permissionList, + std::vector& permStateList, bool crossIpc = false); /** * @brief Get permission definition by permission name. diff --git a/interfaces/innerkits/accesstoken/libaccesstoken_sdk.map b/interfaces/innerkits/accesstoken/libaccesstoken_sdk.map index 7f35bfed9..758d31c9b 100644 --- a/interfaces/innerkits/accesstoken/libaccesstoken_sdk.map +++ b/interfaces/innerkits/accesstoken/libaccesstoken_sdk.map @@ -72,6 +72,7 @@ "OHOS::Security::AccessToken::TokenSyncCallback::~TokenSyncCallback()"; "OHOS::Security::AccessToken::TokenSyncKitInterface::TokenSyncKitInterface()"; "OHOS::Security::AccessToken::TokenSyncKitInterface::~TokenSyncKitInterface()"; + "OHOS::Security::AccessToken::AccessTokenKit::VerifyAccessToken(unsigned int, std::__h::vector, std::__h::allocator>, std::__h::allocator, std::__h::allocator>>> const&, std::__h::vector>&, bool)"; "OHOS::Security::AccessToken::AccessTokenKit::GrantPermissionForSpecifiedTime(unsigned int, std::__h::basic_string, std::__h::allocator> const&, unsigned int)"; "OHOS::Security::AccessToken::AccessTokenKit::GetHapTokenInfoExtension(unsigned int, OHOS::Security::AccessToken::HapTokenInfoExt&)"; ""; diff --git a/interfaces/innerkits/accesstoken/src/accesstoken_kit.cpp b/interfaces/innerkits/accesstoken/src/accesstoken_kit.cpp index 7feb24573..9bbc2761f 100644 --- a/interfaces/innerkits/accesstoken/src/accesstoken_kit.cpp +++ b/interfaces/innerkits/accesstoken/src/accesstoken_kit.cpp @@ -312,6 +312,50 @@ int AccessTokenKit::VerifyAccessToken( return AccessTokenKit::VerifyAccessToken(firstTokenID, permissionName); } +int AccessTokenKit::VerifyAccessToken(AccessTokenID tokenID, const std::vector& permissionList, + std::vector& permStateList, bool crossIpc) +{ + ACCESSTOKEN_LOG_DEBUG(LABEL, "TokenID=%{public}d, permissionlist.size=%{public}d, crossIpc=%{public}d.", + tokenID, permissionList.size(), crossIpc); + permStateList.clear(); + if (crossIpc) { + return AccessTokenManagerClient::GetInstance().VerifyAccessToken(tokenID, permissionList, permStateList); + } + + permStateList.resize(permissionList.size(), PERMISSION_DENIED); + std::vector permListCrossIpc; + std::unordered_map permToState; + for (int i = 0; i < permissionList.size(); i++) { + bool isGranted = false; + uint32_t code; + if (!TransferPermissionToOpcode(permissionList[i], code)) { + permStateList[i] = PERMISSION_DENIED; + continue; + } + int32_t ret = GetPermissionFromKernel(tokenID, code, isGranted); + if (ret != 0) { + permToState[permListCrossIpc.size()] = i; + permListCrossIpc.emplace_back(permissionList[i]); + continue; + } + permStateList[i] = isGranted ? PERMISSION_GRANTED : PERMISSION_DENIED; + } + if (!permListCrossIpc.empty()) { + std::vector permStateCrossIpc; + int ret = AccessTokenManagerClient::GetInstance().VerifyAccessToken(tokenID, + permListCrossIpc, permStateCrossIpc); + if (ret != ERR_OK) { + return ret; + } + for (int i = 0; i < permStateCrossIpc.size(); i++) { + if (permToState.count(i)) { + permStateList[permToState[i]] = permStateCrossIpc[i]; + } + } + } + return ERR_OK; +} + int AccessTokenKit::GetDefPermission(const std::string& permissionName, PermissionDef& permissionDefResult) { ACCESSTOKEN_LOG_DEBUG(LABEL, "PermissionName=%{public}s.", permissionName.c_str()); diff --git a/interfaces/innerkits/accesstoken/src/accesstoken_manager_client.cpp b/interfaces/innerkits/accesstoken/src/accesstoken_manager_client.cpp index 7d3ba7a82..f333a6b33 100644 --- a/interfaces/innerkits/accesstoken/src/accesstoken_manager_client.cpp +++ b/interfaces/innerkits/accesstoken/src/accesstoken_manager_client.cpp @@ -94,6 +94,17 @@ int AccessTokenManagerClient::VerifyAccessToken(AccessTokenID tokenID, const std return PERMISSION_DENIED; } +int AccessTokenManagerClient::VerifyAccessToken(AccessTokenID tokenID, + const std::vector& permissionList, std::vector& permStateList) +{ + auto proxy = GetProxy(); + if (proxy == nullptr) { + ACCESSTOKEN_LOG_ERROR(LABEL, "Proxy is null"); + return AccessTokenError::ERR_SERVICE_ABNORMAL; + } + return proxy->VerifyAccessToken(tokenID, permissionList, permStateList); +} + int AccessTokenManagerClient::GetDefPermission( const std::string& permissionName, PermissionDef& permissionDefResult) { diff --git a/interfaces/innerkits/accesstoken/src/accesstoken_manager_client.h b/interfaces/innerkits/accesstoken/src/accesstoken_manager_client.h index 61ceeb353..61e91cf5b 100644 --- a/interfaces/innerkits/accesstoken/src/accesstoken_manager_client.h +++ b/interfaces/innerkits/accesstoken/src/accesstoken_manager_client.h @@ -50,6 +50,8 @@ public: PermUsedTypeEnum GetPermissionUsedType(AccessTokenID tokenID, const std::string& permissionName); int VerifyAccessToken(AccessTokenID tokenID, const std::string& permissionName); + int VerifyAccessToken(AccessTokenID tokenID, + const std::vector& permissionList, std::vector& permStateList); int GetDefPermission(const std::string& permissionName, PermissionDef& permissionDefResult); int GetDefPermissions(AccessTokenID tokenID, std::vector& permList); int GetReqPermissions( diff --git a/interfaces/innerkits/accesstoken/src/accesstoken_manager_proxy.cpp b/interfaces/innerkits/accesstoken/src/accesstoken_manager_proxy.cpp index b7685d1c8..da1d8e62e 100644 --- a/interfaces/innerkits/accesstoken/src/accesstoken_manager_proxy.cpp +++ b/interfaces/innerkits/accesstoken/src/accesstoken_manager_proxy.cpp @@ -114,6 +114,36 @@ int AccessTokenManagerProxy::VerifyAccessToken(AccessTokenID tokenID, const std: return result; } +int AccessTokenManagerProxy::VerifyAccessToken(AccessTokenID tokenID, + const std::vector& permissionList, std::vector& permStateList) +{ + MessageParcel data; + if (!data.WriteInterfaceToken(IAccessTokenManager::GetDescriptor())) { + ACCESSTOKEN_LOG_ERROR(LABEL, "WriteInterfaceToken failed."); + return ERR_WRITE_PARCEL_FAILED; + } + if (!data.WriteUint32(tokenID)) { + ACCESSTOKEN_LOG_ERROR(LABEL, "WriteUint32 failed."); + return ERR_WRITE_PARCEL_FAILED; + } + if (!data.WriteStringVector(permissionList)) { + ACCESSTOKEN_LOG_ERROR(LABEL, "WriteStringVector failed."); + return ERR_WRITE_PARCEL_FAILED; + } + + MessageParcel reply; + if (!SendRequest(AccessTokenInterfaceCode::VERIFY_ACCESSTOKEN_WITH_LIST, data, reply)) { + return ERR_SERVICE_ABNORMAL; + } + + if (!reply.ReadInt32Vector(&permStateList)) { + ACCESSTOKEN_LOG_ERROR(LABEL, "ReadInt32Vector failed."); + return ERR_READ_PARCEL_FAILED; + } + + return ERR_OK; +} + int AccessTokenManagerProxy::GetDefPermission( const std::string& permissionName, PermissionDefParcel& permissionDefResult) { diff --git a/interfaces/innerkits/accesstoken/src/accesstoken_manager_proxy.h b/interfaces/innerkits/accesstoken/src/accesstoken_manager_proxy.h index 88131f667..58be53d78 100644 --- a/interfaces/innerkits/accesstoken/src/accesstoken_manager_proxy.h +++ b/interfaces/innerkits/accesstoken/src/accesstoken_manager_proxy.h @@ -45,6 +45,8 @@ public: PermUsedTypeEnum GetPermissionUsedType( AccessTokenID tokenID, const std::string& permissionName) override; int VerifyAccessToken(AccessTokenID tokenID, const std::string& permissionName) override; + int VerifyAccessToken(AccessTokenID tokenID, + const std::vector& permissionList, std::vector& permStateList) override; int GetDefPermission(const std::string& permissionName, PermissionDefParcel& permissionDefResult) override; int GetDefPermissions(AccessTokenID tokenID, std::vector& permList) override; int GetReqPermissions( diff --git a/interfaces/innerkits/accesstoken/test/unittest/accesstoken_mock_test/accesstoken_kit_test.cpp b/interfaces/innerkits/accesstoken/test/unittest/accesstoken_mock_test/accesstoken_kit_test.cpp index ffffebb0d..26c61023e 100644 --- a/interfaces/innerkits/accesstoken/test/unittest/accesstoken_mock_test/accesstoken_kit_test.cpp +++ b/interfaces/innerkits/accesstoken/test/unittest/accesstoken_mock_test/accesstoken_kit_test.cpp @@ -239,6 +239,25 @@ HWTEST_F(AccessTokenKitTest, VerifyAccessToken002, TestSize.Level1) ASSERT_EQ(PERMISSION_DENIED, AccessTokenKit::VerifyAccessToken(callerTokenID, firstTokenID, permission, true)); } +/** + * @tc.name: VerifyAccessTokenWithList001 + * @tc.desc: VerifyAccessTokenWithList with proxy is null + * @tc.type: FUNC + * @tc.require: + */ +HWTEST_F(AccessTokenKitTest, VerifyAccessTokenWithList001, TestSize.Level1) +{ + AccessTokenID tokenId = 123; + std::vector permissionList = {"ohos.permission.CAMERA"}; + std::vector permStateList; + ASSERT_EQ(AccessTokenError::ERR_SERVICE_ABNORMAL, + AccessTokenKit::VerifyAccessToken(tokenId, permissionList, permStateList, true)); + + permStateList.clear(); + ASSERT_EQ(AccessTokenError::ERR_SERVICE_ABNORMAL, + AccessTokenKit::VerifyAccessToken(tokenId, permissionList, permStateList, false)); +} + /** * @tc.name: GetDefPermission001 * @tc.desc: GetDefPermission with proxy is null diff --git a/interfaces/innerkits/accesstoken/test/unittest/src/accesstoken_kit_test.cpp b/interfaces/innerkits/accesstoken/test/unittest/src/accesstoken_kit_test.cpp index e6c4d9d20..beae5a192 100644 --- a/interfaces/innerkits/accesstoken/test/unittest/src/accesstoken_kit_test.cpp +++ b/interfaces/innerkits/accesstoken/test/unittest/src/accesstoken_kit_test.cpp @@ -1190,6 +1190,97 @@ HWTEST_F(AccessTokenKitTest, VerifyAccessToken004, TestSize.Level0) ASSERT_EQ(PERMISSION_GRANTED, ret); } +/** + * @tc.name: VerifyAccessTokenWithList001 + * @tc.desc: Verify permission with list. + * @tc.type: FUNC + * @tc.require: Issue Number + */ +HWTEST_F(AccessTokenKitTest, VerifyAccessTokenWithList001, TestSize.Level0) +{ + AccessTokenID tokenID = GetAccessTokenID(TEST_USER_ID, TEST_BUNDLE_NAME, 0); + ASSERT_NE(INVALID_TOKENID, tokenID); + int ret = AccessTokenKit::GrantPermission(tokenID, TEST_PERMISSION_NAME_A_MICRO, PERMISSION_USER_FIXED); + ASSERT_EQ(RET_SUCCESS, ret); + ret = AccessTokenKit::GrantPermission(tokenID, TEST_PERMISSION_NAME_A_CAMERA, PERMISSION_USER_FIXED); + ASSERT_EQ(RET_SUCCESS, ret); + + std::vector permissionList; + permissionList.emplace_back(TEST_PERMISSION_NAME_A_MICRO); + permissionList.emplace_back(TEST_PERMISSION_NAME_A_CAMERA); + + std::vector permStateList; + ret = AccessTokenKit::VerifyAccessToken(tokenID, permissionList, permStateList); + for (int i = 0; i < permissionList.size(); i++) { + ASSERT_EQ(PERMISSION_GRANTED, permStateList[i]); + } + + permStateList.clear(); + ret = AccessTokenKit::VerifyAccessToken(tokenID, permissionList, permStateList, true); + for (int i = 0; i < permissionList.size(); i++) { + ASSERT_EQ(PERMISSION_GRANTED, permStateList[i]); + } + + ret = AccessTokenKit::RevokePermission(tokenID, TEST_PERMISSION_NAME_A_MICRO, PERMISSION_USER_FIXED); + ASSERT_EQ(RET_SUCCESS, ret); + ret = AccessTokenKit::RevokePermission(tokenID, TEST_PERMISSION_NAME_A_CAMERA, PERMISSION_USER_FIXED); + ASSERT_EQ(RET_SUCCESS, ret); + + permStateList.clear(); + ret = AccessTokenKit::VerifyAccessToken(tokenID, permissionList, permStateList); + for (int i = 0; i < permissionList.size(); i++) { + ASSERT_EQ(PERMISSION_DENIED, permStateList[i]); + } + + permStateList.clear(); + ret = AccessTokenKit::VerifyAccessToken(tokenID, permissionList, permStateList, true); + for (int i = 0; i < permissionList.size(); i++) { + ASSERT_EQ(PERMISSION_DENIED, permStateList[i]); + } +} + +/** + * @tc.name: VerifyAccessTokenWithList002 + * @tc.desc: Verify permission that tokenID or permission is invalid. + * @tc.type: FUNC + * @tc.require: Issue Number + */ +HWTEST_F(AccessTokenKitTest, VerifyAccessTokenWithList002, TestSize.Level0) +{ + AccessTokenID tokenID = GetAccessTokenID(TEST_USER_ID, TEST_BUNDLE_NAME, 0); + ASSERT_NE(INVALID_TOKENID, tokenID); + + std::vector permissionList; + permissionList.emplace_back(TEST_PERMISSION_NAME_GAMMA); + std::vector permStateList; + int ret = AccessTokenKit::VerifyAccessToken(tokenID, permissionList, permStateList, false); + ASSERT_EQ(RET_SUCCESS, ret); + ASSERT_EQ(PERMISSION_DENIED, permStateList[0]); + + permissionList.clear(); + permissionList.emplace_back(""); + permStateList.clear(); + ret = AccessTokenKit::VerifyAccessToken(tokenID, permissionList, permStateList); + ASSERT_EQ(RET_SUCCESS, ret); + ASSERT_EQ(PERMISSION_DENIED, permStateList[0]); + + std::string invalidPerm(INVALID_PERMNAME_LEN, 'a'); + permissionList.clear(); + permissionList.emplace_back(invalidPerm); + permStateList.clear(); + ret = AccessTokenKit::VerifyAccessToken(tokenID, permissionList, permStateList); + ASSERT_EQ(RET_SUCCESS, ret); + ASSERT_EQ(PERMISSION_DENIED, permStateList[0]); + + permissionList.clear(); + permissionList.emplace_back(TEST_PERMISSION_NAME_A_MICRO); + permissionList.emplace_back(TEST_PERMISSION_NAME_A_CAMERA); + permStateList.clear(); + ret = AccessTokenKit::VerifyAccessToken(TEST_TOKENID_INVALID, permissionList, permStateList); + ASSERT_EQ(RET_SUCCESS, ret); + ASSERT_EQ(PERMISSION_DENIED, permStateList[0]); +} + /** * @tc.name: GrantPermission001 * @tc.desc: Grant permission that has ohos.permission.GRANT_SENSITIVE_PERMISSIONS diff --git a/services/accesstokenmanager/main/cpp/include/service/accesstoken_manager_service.h b/services/accesstokenmanager/main/cpp/include/service/accesstoken_manager_service.h index fd80d8426..eaaa074bd 100644 --- a/services/accesstokenmanager/main/cpp/include/service/accesstoken_manager_service.h +++ b/services/accesstokenmanager/main/cpp/include/service/accesstoken_manager_service.h @@ -51,6 +51,8 @@ public: int32_t InitHapToken(const HapInfoParcel& info, HapPolicyParcel& policy, AccessTokenIDEx& fullTokenId) override; int VerifyAccessToken(AccessTokenID tokenID, const std::string& permissionName) override; + int VerifyAccessToken(AccessTokenID tokenID, + const std::vector& permissionList, std::vector& permStateList) override; int GetDefPermission(const std::string& permissionName, PermissionDefParcel& permissionDefResult) override; int GetDefPermissions(AccessTokenID tokenID, std::vector& permList) override; int GetReqPermissions( diff --git a/services/accesstokenmanager/main/cpp/include/service/accesstoken_manager_stub.h b/services/accesstokenmanager/main/cpp/include/service/accesstoken_manager_stub.h index 45b6ef695..e29aada41 100644 --- a/services/accesstokenmanager/main/cpp/include/service/accesstoken_manager_stub.h +++ b/services/accesstokenmanager/main/cpp/include/service/accesstoken_manager_stub.h @@ -36,6 +36,7 @@ public: private: void GetPermissionUsedTypeInner(MessageParcel& data, MessageParcel& reply); void VerifyAccessTokenInner(MessageParcel& data, MessageParcel& reply); + void VerifyAccessTokenWithListInner(MessageParcel& data, MessageParcel& reply); void GetDefPermissionInner(MessageParcel& data, MessageParcel& reply); void GetDefPermissionsInner(MessageParcel& data, MessageParcel& reply); void GetReqPermissionsInner(MessageParcel& data, MessageParcel& reply); diff --git a/services/accesstokenmanager/main/cpp/src/service/accesstoken_manager_service.cpp b/services/accesstokenmanager/main/cpp/src/service/accesstoken_manager_service.cpp index eec70e2e0..8983fa4e4 100644 --- a/services/accesstokenmanager/main/cpp/src/service/accesstoken_manager_service.cpp +++ b/services/accesstokenmanager/main/cpp/src/service/accesstoken_manager_service.cpp @@ -154,6 +154,17 @@ int AccessTokenManagerService::VerifyAccessToken(AccessTokenID tokenID, const st return res; } +int AccessTokenManagerService::VerifyAccessToken(AccessTokenID tokenID, + const std::vector& permissionList, std::vector& permStateList) +{ + permStateList.clear(); + permStateList.resize(permissionList.size(), PERMISSION_DENIED); + for (int i = 0; i < permissionList.size(); i++) { + permStateList[i] = VerifyAccessToken(tokenID, permissionList[i]); + } + return RET_SUCCESS; +} + int AccessTokenManagerService::GetDefPermission( const std::string& permissionName, PermissionDefParcel& permissionDefResult) { diff --git a/services/accesstokenmanager/main/cpp/src/service/accesstoken_manager_stub.cpp b/services/accesstokenmanager/main/cpp/src/service/accesstoken_manager_stub.cpp index 70a235a1b..e89b70508 100644 --- a/services/accesstokenmanager/main/cpp/src/service/accesstoken_manager_stub.cpp +++ b/services/accesstokenmanager/main/cpp/src/service/accesstoken_manager_stub.cpp @@ -138,6 +138,20 @@ void AccessTokenManagerStub::VerifyAccessTokenInner(MessageParcel& data, Message IF_FALSE_PRINT_LOG(LABEL, reply.WriteInt32(result), "WriteInt32 failed."); } +void AccessTokenManagerStub::VerifyAccessTokenWithListInner(MessageParcel& data, MessageParcel& reply) +{ + AccessTokenID tokenID; + IF_FALSE_RETURN_LOG(LABEL, data.ReadUint32(tokenID), "ReadUint32 failed."); + + std::vector permissionList; + IF_FALSE_RETURN_LOG(LABEL, data.ReadStringVector(&permissionList), "ReadStringVector failed."); + + std::vector permStateList; + this->VerifyAccessToken(tokenID, permissionList, permStateList); + + IF_FALSE_RETURN_LOG(LABEL, reply.WriteInt32Vector(permStateList), "WriteInt32Vector failed."); +} + void AccessTokenManagerStub::GetDefPermissionInner(MessageParcel& data, MessageParcel& reply) { std::string permissionName = data.ReadString(); @@ -1039,6 +1053,8 @@ void AccessTokenManagerStub::SetPermissionOpFuncInMap() &AccessTokenManagerStub::GetPermissionUsedTypeInner; requestFuncMap_[static_cast(AccessTokenInterfaceCode::VERIFY_ACCESSTOKEN)] = &AccessTokenManagerStub::VerifyAccessTokenInner; + requestFuncMap_[static_cast(AccessTokenInterfaceCode::VERIFY_ACCESSTOKEN_WITH_LIST)] = + &AccessTokenManagerStub::VerifyAccessTokenWithListInner; requestFuncMap_[static_cast(AccessTokenInterfaceCode::GET_DEF_PERMISSION)] = &AccessTokenManagerStub::GetDefPermissionInner; requestFuncMap_[static_cast(AccessTokenInterfaceCode::GET_DEF_PERMISSIONS)] = diff --git a/test/fuzztest/innerkits/accesstoken/BUILD.gn b/test/fuzztest/innerkits/accesstoken/BUILD.gn index 183ba9750..4ca95adfa 100644 --- a/test/fuzztest/innerkits/accesstoken/BUILD.gn +++ b/test/fuzztest/innerkits/accesstoken/BUILD.gn @@ -57,5 +57,6 @@ group("fuzztest") { "updatehaptoken_fuzzer:UpdateHapTokenFuzzTest", "verifyaccesstoken001_fuzzer:VerifyAccessToken001FuzzTest", "verifyaccesstoken_fuzzer:VerifyAccessTokenFuzzTest", + "verifyaccesstokenwithlist_fuzzer:VerifyAccessTokenWithListFuzzTest", ] } diff --git a/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/BUILD.gn b/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/BUILD.gn new file mode 100644 index 000000000..200fd1490 --- /dev/null +++ b/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/BUILD.gn @@ -0,0 +1,43 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/config/features.gni") +import("//build/test.gni") +import("../../../../../access_token.gni") + +ohos_fuzztest("VerifyAccessTokenWithListFuzzTest") { + module_out_path = module_output_path_interface_access_token + fuzz_config_file = "." + include_dirs = [ + "${access_token_path}/interfaces/innerkits/accesstoken/include", + "${access_token_path}/test/fuzztest/common", + ] + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + sources = [ "verifyaccesstokenwithlist_fuzzer.cpp" ] + + deps = [ + "${access_token_path}/interfaces/innerkits/accesstoken:libaccesstoken_sdk", + ] + + configs = [ "${access_token_path}/config:coverage_flags" ] + + external_deps = [ + "c_utils:utils", + "hilog:libhilog", + ] +} diff --git a/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/corpus/init b/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/corpus/init new file mode 100644 index 000000000..e7c3fecd8 --- /dev/null +++ b/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/corpus/init @@ -0,0 +1,14 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/project.xml b/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/project.xml new file mode 100644 index 000000000..7133b2b92 --- /dev/null +++ b/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/verifyaccesstokenwithlist_fuzzer.cpp b/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/verifyaccesstokenwithlist_fuzzer.cpp new file mode 100644 index 000000000..691122aeb --- /dev/null +++ b/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/verifyaccesstokenwithlist_fuzzer.cpp @@ -0,0 +1,58 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "verifyaccesstokenwithlist_fuzzer.h" + +#include +#include +#include +#include "accesstoken_fuzzdata.h" +#undef private +#include "accesstoken_kit.h" + +using namespace std; +using namespace OHOS::Security::AccessToken; +const int32_t MAX_PERMISSION_SIZE = 1100; + +namespace OHOS { + bool VerifyAccessTokenWithListFuzzTest(const uint8_t* data, size_t size) + { + if ((data == nullptr) || (size == 0)) { + return false; + } + + AccessTokenFuzzData fuzzData(data, size); + + int permSize = fuzzData.GetData() % MAX_PERMISSION_SIZE; + std::vector permissionList; + std::vector permStateList; + for (int i = 0; i < permSize; i++) { + permissionList.emplace_back(fuzzData.GenerateStochasticString()); + } + + int32_t result = AccessTokenKit::VerifyAccessToken( + fuzzData.GetData(), permissionList, permStateList, false); + + return result == RET_SUCCESS; + } +} + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + OHOS::VerifyAccessTokenWithListFuzzTest(data, size); + return 0; +} diff --git a/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/verifyaccesstokenwithlist_fuzzer.h b/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/verifyaccesstokenwithlist_fuzzer.h new file mode 100644 index 000000000..9c91937d4 --- /dev/null +++ b/test/fuzztest/innerkits/accesstoken/verifyaccesstokenwithlist_fuzzer/verifyaccesstokenwithlist_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef TEST_FUZZTEST_VERIFYACCESSTOKENWITHLIST_FUZZER_H +#define TEST_FUZZTEST_VERIFYACCESSTOKENWITHLIST_FUZZER_H + +#define FUZZ_PROJECT_NAME "verifyaccesstokenwithlist_fuzzer" + +#endif // TEST_FUZZTEST_VERIFYACCESSTOKENWITHLIST_FUZZER_H diff --git a/test/fuzztest/services/accesstoken/BUILD.gn b/test/fuzztest/services/accesstoken/BUILD.gn index 714103d69..06951b706 100644 --- a/test/fuzztest/services/accesstoken/BUILD.gn +++ b/test/fuzztest/services/accesstoken/BUILD.gn @@ -49,6 +49,7 @@ group("fuzztest") { "setremotehaptokeninfostub_fuzzer:SetRemoteHapTokenInfoStubFuzzTest", "updatehaptokenstub_fuzzer:UpdateHapTokenStubFuzzTest", "verifyaccesstokenstub_fuzzer:VerifyAccessTokenStubFuzzTest", + "verifyaccesstokenwithliststub_fuzzer:VerifyAccessTokenWithListStubFuzzTest", ] if (is_standard_system && token_sync_enable == true) { diff --git a/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/BUILD.gn b/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/BUILD.gn new file mode 100644 index 000000000..1d6648b8f --- /dev/null +++ b/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/BUILD.gn @@ -0,0 +1,47 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import("//build/config/features.gni") +import("//build/test.gni") +import("../../../../../access_token.gni") +import("../access_token_service_fuzz.gni") + +ohos_fuzztest("VerifyAccessTokenWithListStubFuzzTest") { + module_out_path = module_output_path_service_access_token + fuzz_config_file = "." + + sources = [ "verifyaccesstokenwithliststub_fuzzer.cpp" ] + + cflags = [ + "-g", + "-O0", + "-Wno-unused-variable", + "-fno-omit-frame-pointer", + ] + + include_dirs = access_token_include_dirs + + deps = access_token_deps + + configs = [ "${access_token_path}/config:coverage_flags" ] + + external_deps = access_token_external_deps + + include_dirs += access_token_impl_include_dirs + + cflags_cc = access_token_cflags_cc + + sources += access_token_sources + + sources += access_token_impl_sources +} diff --git a/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/corpus/init b/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/corpus/init new file mode 100644 index 000000000..e7c3fecd8 --- /dev/null +++ b/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/corpus/init @@ -0,0 +1,14 @@ +# Copyright (c) 2024 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +FUZZ \ No newline at end of file diff --git a/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/project.xml b/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/project.xml new file mode 100644 index 000000000..7133b2b92 --- /dev/null +++ b/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/project.xml @@ -0,0 +1,25 @@ + + + + + + 1000 + + 300 + + 4096 + + diff --git a/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/verifyaccesstokenwithliststub_fuzzer.cpp b/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/verifyaccesstokenwithliststub_fuzzer.cpp new file mode 100644 index 000000000..af153efff --- /dev/null +++ b/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/verifyaccesstokenwithliststub_fuzzer.cpp @@ -0,0 +1,67 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "verifyaccesstokenwithliststub_fuzzer.h" + +#include +#include +#include +#undef private +#include "accesstoken_fuzzdata.h" +#include "accesstoken_manager_service.h" +#include "i_accesstoken_manager.h" + +using namespace std; +using namespace OHOS::Security::AccessToken; +const int32_t MAX_PERMISSION_SIZE = 1100; + +namespace OHOS { + bool VerifyAccessTokenWithListStubFuzzTest(const uint8_t* data, size_t size) + { + if ((data == nullptr) || (size == 0)) { + return false; + } + + AccessTokenFuzzData fuzzData(data, size); + AccessTokenID tokenId = fuzzData.GetData(); + + int permSize = fuzzData.GetData() % MAX_PERMISSION_SIZE; + std::vector permissionList; + for (int i = 0; i < permSize; i++) { + permissionList.emplace_back(fuzzData.GenerateStochasticString()); + } + MessageParcel datas; + datas.WriteInterfaceToken(IAccessTokenManager::GetDescriptor()); + if (!datas.WriteUint32(tokenId) || !datas.WriteStringVector(permissionList)) { + return false; + } + + uint32_t code = static_cast(AccessTokenInterfaceCode::VERIFY_ACCESSTOKEN_WITH_LIST); + + MessageParcel reply; + MessageOption option; + DelayedSingleton::GetInstance()->OnRemoteRequest(code, datas, reply, option); + + return true; + } +} // namespace OHOS + +/* Fuzzer entry point */ +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + /* Run your code on data */ + OHOS::VerifyAccessTokenWithListStubFuzzTest(data, size); + return 0; +} diff --git a/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/verifyaccesstokenwithliststub_fuzzer.h b/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/verifyaccesstokenwithliststub_fuzzer.h new file mode 100644 index 000000000..acdc2357c --- /dev/null +++ b/test/fuzztest/services/accesstoken/verifyaccesstokenwithliststub_fuzzer/verifyaccesstokenwithliststub_fuzzer.h @@ -0,0 +1,21 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef TEST_FUZZTEST_VERIFYACCESSTOKENWITHLISTSTUB_FUZZER_H +#define TEST_FUZZTEST_VERIFYACCESSTOKENWITHLISTSTUB_FUZZER_H + +#define FUZZ_PROJECT_NAME "verifyaccesstokenwithliststub_fuzzer" + +#endif // TEST_FUZZTEST_VERIFYACCESSTOKENWITHLISTSTUB_FUZZER_H -- Gitee