Extension黑白名单管控增强

Signed-off-by: zhangyuhang72 <zhangyuhang72@huawei.com>
Change-Id: I415e64c9921de67ff8dcd19b2c5b32f4f8eb5b2c

frameworks/native/ability/native/ability_business_error/ability_business_error.cpp

@@ -100,6 +100,8 @@ constexpr const char* ERROR_MSG_UPPER_LIMIT = "The number of app instances reach
 constexpr const char* ERROR_MSG_APP_INSTANCE_KEY_NOT_SUPPORT = "The APP_INSTANCE_KEY cannot be specified.";
 constexpr const char* ERROR_MSG_CREATE_NEW_INSTANCE_NOT_SUPPORT = "Creating a new instance is not supported.";
 constexpr const char* ERROR_MSG_UI_ABILITY_IS_STARTING = "The UIAbility is being started.";
+constexpr const char* ERROR_MSG_EXTENSION_START_ABILITY_CONTROLLED =
+    "The extension can not start the ability due to extension control.";
 
 // follow ERR_BUNDLE_MANAGER_BUNDLE_NOT_EXIST of appexecfwk_errors.h in bundle_framework
 constexpr int32_t ERR_BUNDLE_MANAGER_BUNDLE_NOT_EXIST = 8521220;
@@ -172,6 +174,7 @@ static std::unordered_map<AbilityErrorCode, const char*> ERR_CODE_MAP = {
     { AbilityErrorCode::ERROR_CODE_APP_INSTANCE_KEY_NOT_SUPPORT, ERROR_MSG_APP_INSTANCE_KEY_NOT_SUPPORT },
     { AbilityErrorCode::ERROR_CODE_CREATE_NEW_INSTANCE_NOT_SUPPORT, ERROR_MSG_CREATE_NEW_INSTANCE_NOT_SUPPORT },
     { AbilityErrorCode::ERROR_CODE_UI_ABILITY_IS_STARTING, ERROR_MSG_UI_ABILITY_IS_STARTING},
+    { AbilityErrorCode::ERROR_CODE_EXTENSION_START_ABILITY_CONTROLLED, ERROR_MSG_EXTENSION_START_ABILITY_CONTROLLED },
 };
 
 static std::unordered_map<int32_t, AbilityErrorCode> INNER_TO_JS_ERROR_CODE_MAP {
@@ -247,6 +250,7 @@ static std::unordered_map<int32_t, AbilityErrorCode> INNER_TO_JS_ERROR_CODE_MAP
     {ERR_APP_INSTANCE_KEY_NOT_SUPPORT, AbilityErrorCode::ERROR_CODE_APP_INSTANCE_KEY_NOT_SUPPORT},
     {ERR_CREATE_NEW_INSTANCE_NOT_SUPPORT, AbilityErrorCode::ERROR_CODE_CREATE_NEW_INSTANCE_NOT_SUPPORT},
     {ERR_UI_ABILITY_IS_STARTING, AbilityErrorCode::ERROR_CODE_UI_ABILITY_IS_STARTING},
+    {ERR_EXTENSION_START_ABILITY_CONTROLEED, AbilityErrorCode::ERROR_CODE_EXTENSION_START_ABILITY_CONTROLLED},
 };
 }
 

interfaces/inner_api/ability_manager/include/ability_manager_errors.h

@@ -703,6 +703,11 @@ enum {
     ERR_NULL_APP_MGR_PROXY = 2097303,
     ERR_NO_APP_RECORD = 2097304,
 
+    /*
+     * Result(2097305) for extension starting ability controlled
+     */
+    ERR_EXTENSION_START_ABILITY_CONTROLEED = 2097305,
+
     /**
      * Native error(3000000) for target bundle not exist.
      */

interfaces/kits/native/ability/native/ability_business_error/ability_business_error.h

@@ -183,6 +183,9 @@ enum class AbilityErrorCode {
     // UIAbility is in starting state.
     ERROR_CODE_UI_ABILITY_IS_STARTING = 16000082,
 
+    // extension can not start the ability due to extension control.
+    ERROR_CODE_EXTENSION_START_ABILITY_CONTROLLED = 16000083,
+
     // invalid caller.
     ERROR_CODE_INVALID_CALLER = 16200001,
 

services/abilitymgr/include/extension_config.h

@@ -19,6 +19,7 @@
 #include <map>
 #include <mutex>
 #include <nlohmann/json.hpp>
+#include <optional>
 #include <unordered_map>
 #include <unordered_set>
 
@@ -33,6 +34,14 @@ constexpr static bool EXTENSION_SA_ENABLE_FLAG_DEFAULT = true;
 constexpr static bool EXTENSION_THIRD_PARTY_APP_ENABLE_FLAG_DEFAULT = true;
 constexpr static bool EXTENSION_START_SERVICE_ENABLE_FLAG_DEFAULT = true;
 
+struct AbilityAccessItem {
+    std::optional<bool> thirdPartyAppAccessFlag = std::nullopt;
+    std::optional<bool> serviceAccessFlag = std::nullopt;
+    std::optional<bool> defaultAccessFlag = std::nullopt;
+    std::unordered_set<std::string> blockList;
+    std::unordered_set<std::string> allowList;
+};
+
 struct ExtensionConfigItem {
     bool networkEnableFlag = EXTENSION_NETWORK_ENABLE_FLAG_DEFAULT;
     bool saEnableFlag = EXTENSION_SA_ENABLE_FLAG_DEFAULT;
@@ -40,6 +49,8 @@ struct ExtensionConfigItem {
     bool serviceEnableFlag = EXTENSION_START_SERVICE_ENABLE_FLAG_DEFAULT;
     int32_t extensionAutoDisconnectTime = DEFAULT_EXTENSION_AUTO_DISCONNECT_TIME;
     std::unordered_set<std::string> serviceBlockedList;
+    AbilityAccessItem abilityAccess;
+    bool hasAbilityAccess = false;
 };
 
 class ExtensionConfig : public DelayedSingleton<ExtensionConfig> {
@@ -50,6 +61,13 @@ public:
     int32_t GetExtensionAutoDisconnectTime(const std::string &extensionTypeName);
     bool IsExtensionStartThirdPartyAppEnable(const std::string &extensionTypeName);
     bool IsExtensionStartServiceEnable(const std::string &extensionTypeName, const std::string &targetUri);
+    bool HasAbilityAccess(const std::string &extensionTypeName);
+    bool HasThridPartyAppAccessFlag(const std::string &extensionTypeName);
+    bool HasServiceAccessFlag(const std::string &extensionTypeName);
+    bool HasDefaultAccessFlag(const std::string &extensionTypeName);
+    bool IsExtensionStartThirdPartyAppEnableNew(const std::string &extensionTypeName, const std::string &targetUri);
+    bool IsExtensionStartServiceEnableNew(const std::string &extensionTypeName, const std::string &targetUri);
+    bool IsExtensionStartDefaultEnable(const std::string &extensionTypeName, const std::string &targetUri);
     bool IsExtensionNetworkEnable(const std::string &extensionTypeName);
     bool IsExtensionSAEnable(const std::string &extensionTypeName);
 private:
@@ -57,13 +75,22 @@ private:
     bool ReadFileInfoJson(const std::string &filePath, nlohmann::json &jsonBuf);
 
     std::string GetExtensionConfigPath() const;
-    void LoadExtensionAutoDisconnectTime(const nlohmann::json &object, std::string extensionTypeName);
+    void LoadExtensionAutoDisconnectTime(const nlohmann::json &object, const std::string &extensionTypeName);
     void LoadExtensionThirdPartyAppBlockedList(const nlohmann::json &object, std::string extensionTypeName);
     void LoadExtensionServiceBlockedList(const nlohmann::json &object, std::string extensionTypeNameobject);
     void LoadExtensionNetworkEnable(const nlohmann::json &object, const std::string &extensionTypeName);
     void LoadExtensionSAEnable(const nlohmann::json &object, const std::string &extensionTypeName);
+    bool LoadExtensionAbilityAccess(const nlohmann::json &object, const std::string &extensionTypeName);
+    void LoadExtensionAllowOrBlockedList(const nlohmann::json &object, const std::string &key,
+        std::unordered_set<std::string> &list);
 
-    bool CheckServiceExtensionUriValid(const std::string &uri);
+    std::optional<bool> GetSingleAccessFlag(const std::string &extensionTypeName,
+        std::function<std::optional<bool>(const AbilityAccessItem&)> getAccessFlag);
+    bool IsExtensionAbilityAccessEnable(const std::string &extensionTypeName, const std::string &targetUri,
+        std::function<std::optional<bool>(const AbilityAccessItem&)> getAccessFlag);
+    bool FindTargetUriInList(const AppExecFwk::ElementName &targetElementName, std::unordered_set<std::string> &list);
+    std::string FormatAccessFlag(const std::optional<bool> &flag);
+    bool CheckExtensionUriValid(const std::string &uri);
 
     std::unordered_map<std::string, ExtensionConfigItem> configMap_;
     std::mutex configMapMutex_;

services/abilitymgr/include/interceptor/extension_control_interceptor.h

@@ -34,6 +34,10 @@ private:
         AppExecFwk::AbilityInfo& callerAbilityInfo);
     bool GetTargetAbilityInfo(const AbilityInterceptorParam& param,
         AppExecFwk::AbilityInfo& callerAbilityInfo);
+    int32_t ProcessInterceptOld(const AbilityInterceptorParam& param,
+        const AppExecFwk::AbilityInfo &targetAbilityInfo, const AppExecFwk::AbilityInfo &callerAbilityInfo);
+    int32_t ProcessInterceptNew(const AbilityInterceptorParam& param,
+        const AppExecFwk::AbilityInfo &targetAbilityInfo, const AppExecFwk::AbilityInfo &callerAbilityInfo);
 };
 } // namespace AAFwk
 } // namespace OHOS

services/abilitymgr/src/extension_config.cpp

@@ -19,6 +19,7 @@
 
 #include "config_policy_utils.h"
 #include "hilog_tag_wrapper.h"
+#include "json_utils.h"
 
 namespace OHOS {
 namespace AAFwk {
@@ -30,11 +31,20 @@ constexpr const char* EXTENSION_CONFIG_NAME = "ams_extension_config";
 constexpr const char* EXTENSION_TYPE_NAME = "extension_type_name";
 constexpr const char* EXTENSION_AUTO_DISCONNECT_TIME = "auto_disconnect_time";
 
+// old access flag, deprecated
 constexpr const char* EXTENSION_THIRD_PARTY_APP_BLOCKED_FLAG_NAME = "third_party_app_blocked_flag";
 constexpr const char* EXTENSION_SERVICE_BLOCKED_LIST_NAME = "service_blocked_list";
 constexpr const char* EXTENSION_SERVICE_STARTUP_ENABLE_FLAG = "service_startup_enable_flag";
-constexpr const char* EXTENSION_NETWORK_ENABLE_FLAG = "network_access_enable_flag";
-constexpr const char* EXTENSION_SA_ENABLE_FLAG = "sa_access_enable_flag";
+
+// new access flag
+constexpr const char* ABILITY_ACCESS = "ability_access";
+constexpr const char* THIRD_PARTY_APP_ACCESS_FLAG = "third_party_app_access_flag";
+constexpr const char* SERVICE_ACCESS_FLAG = "service_access_flag";
+constexpr const char* DEFAULT_ACCESS_FLAG = "default_access_flag";
+constexpr const char* BLOCK_LIST = "blocklist";
+constexpr const char* ALLOW_LIST = "allowlist";
+constexpr const char* NETWORK_ACCESS_ENABLE_FLAG = "network_access_enable_flag";
+constexpr const char* SA_ACCESS_ENABLE_FLAG = "sa_access_enable_flag";
 }
 
 std::string ExtensionConfig::GetExtensionConfigPath() const
@@ -115,14 +125,18 @@ void ExtensionConfig::LoadExtensionConfig(const nlohmann::json &object)
         std::lock_guard lock(configMapMutex_);
         std::string extensionTypeName = jsonObject.at(EXTENSION_TYPE_NAME).get<std::string>();
         LoadExtensionAutoDisconnectTime(jsonObject, extensionTypeName);
-        LoadExtensionThirdPartyAppBlockedList(jsonObject, extensionTypeName);
-        LoadExtensionServiceBlockedList(jsonObject, extensionTypeName);
+        bool hasAbilityAccess = LoadExtensionAbilityAccess(jsonObject, extensionTypeName);
+        if (!hasAbilityAccess) {
+            LoadExtensionThirdPartyAppBlockedList(jsonObject, extensionTypeName);
+            LoadExtensionServiceBlockedList(jsonObject, extensionTypeName);
+        }
         LoadExtensionNetworkEnable(jsonObject, extensionTypeName);
         LoadExtensionSAEnable(jsonObject, extensionTypeName);
     }
 }
 
-void ExtensionConfig::LoadExtensionAutoDisconnectTime(const nlohmann::json &object, std::string extensionTypeName)
+void ExtensionConfig::LoadExtensionAutoDisconnectTime(const nlohmann::json &object,
+    const std::string &extensionTypeName)
 {
     if (!object.contains(EXTENSION_AUTO_DISCONNECT_TIME) ||
         !object.at(EXTENSION_AUTO_DISCONNECT_TIME).is_number()) {
@@ -174,7 +188,7 @@ void ExtensionConfig::LoadExtensionServiceBlockedList(const nlohmann::json &obje
             continue;
         }
         std::string serviceUri = jsonObject.get<std::string>();
-        if (CheckServiceExtensionUriValid(serviceUri)) {
+        if (CheckExtensionUriValid(serviceUri)) {
             serviceBlockedList.emplace(serviceUri);
         }
     }
@@ -183,15 +197,72 @@ void ExtensionConfig::LoadExtensionServiceBlockedList(const nlohmann::json &obje
         extensionTypeName.c_str(), serviceBlockedList.size());
 }
 
+bool ExtensionConfig::LoadExtensionAbilityAccess(const nlohmann::json &object, const std::string &extensionTypeName)
+{
+    TAG_LOGD(AAFwkTag::ABILITYMGR, "call.");
+    if (!object.contains(ABILITY_ACCESS) || !object.at(ABILITY_ACCESS).is_object()) {
+        TAG_LOGE(AAFwkTag::ABILITYMGR, "parse ability_access failed");
+        configMap_[extensionTypeName].hasAbilityAccess = false;
+        return false;
+    }
+
+    configMap_[extensionTypeName].hasAbilityAccess = true;
+    const nlohmann::json &accessJson = object.at(ABILITY_ACCESS);
+    auto &abilityAccess = configMap_[extensionTypeName].abilityAccess;
+    auto &jsonUtils = JsonUtils::GetInstance();
+    abilityAccess.thirdPartyAppAccessFlag = jsonUtils.JsonToOptionalBool(accessJson, THIRD_PARTY_APP_ACCESS_FLAG);
+    abilityAccess.serviceAccessFlag = jsonUtils.JsonToOptionalBool(accessJson, SERVICE_ACCESS_FLAG);
+    abilityAccess.defaultAccessFlag = jsonUtils.JsonToOptionalBool(accessJson, DEFAULT_ACCESS_FLAG);
+    LoadExtensionAllowOrBlockedList(accessJson, ALLOW_LIST, abilityAccess.allowList);
+    LoadExtensionAllowOrBlockedList(accessJson, BLOCK_LIST, abilityAccess.blockList);
+
+    TAG_LOGD(AAFwkTag::ABILITYMGR, "The %{public}s extension's ability flag, third:%{public}s, service:%{public}s, "
+        "default:%{public}s, allowList size:%{public}zu, blockList size:%{public}zu,", extensionTypeName.c_str(),
+        FormatAccessFlag(abilityAccess.thirdPartyAppAccessFlag).c_str(),
+        FormatAccessFlag(abilityAccess.serviceAccessFlag).c_str(),
+        FormatAccessFlag(abilityAccess.defaultAccessFlag).c_str(),
+        abilityAccess.allowList.size(), abilityAccess.blockList.size());
+    return true;
+}
+
+std::string ExtensionConfig::FormatAccessFlag(const std::optional<bool> &flag)
+{
+    if (!flag.has_value()) {
+        return "null";
+    }
+    return flag.value() ? "true" : "false";
+}
+
+void ExtensionConfig::LoadExtensionAllowOrBlockedList(const nlohmann::json &object, const std::string &key,
+    std::unordered_set<std::string> &list)
+{
+    TAG_LOGD(AAFwkTag::ABILITYMGR, "LoadExtensionAllowOrBlockedList.");
+    if (!object.contains(key) || !object.at(key).is_array()) {
+        TAG_LOGE(AAFwkTag::ABILITYMGR, "%{public}s config null", key.c_str());
+        return;
+    }
+    list.clear();
+    for (auto &item : object.at(key).items()) {
+        const nlohmann::json& jsonObject = item.value();
+        if (!jsonObject.is_string()) {
+            continue;
+        }
+        std::string serviceUri = jsonObject.get<std::string>();
+        if (CheckExtensionUriValid(serviceUri)) {
+            list.emplace(serviceUri);
+        }
+    }
+}
+
 void ExtensionConfig::LoadExtensionNetworkEnable(const nlohmann::json &object,
     const std::string &extensionTypeName)
 {
     TAG_LOGD(AAFwkTag::ABILITYMGR, "LoadExtensionNetworkEnable call");
-    if (!object.contains(EXTENSION_NETWORK_ENABLE_FLAG) || !object.at(EXTENSION_NETWORK_ENABLE_FLAG).is_boolean()) {
+    if (!object.contains(NETWORK_ACCESS_ENABLE_FLAG) || !object.at(NETWORK_ACCESS_ENABLE_FLAG).is_boolean()) {
         TAG_LOGW(AAFwkTag::ABILITYMGR, "network enable flag null");
         return;
     }
-    bool flag = object.at(EXTENSION_NETWORK_ENABLE_FLAG).get<bool>();
+    bool flag = object.at(NETWORK_ACCESS_ENABLE_FLAG).get<bool>();
     configMap_[extensionTypeName].networkEnableFlag = flag;
     TAG_LOGD(AAFwkTag::ABILITYMGR, "The %{public}s extension's network enable flag is %{public}d",
         extensionTypeName.c_str(), flag);
@@ -201,16 +272,124 @@ void ExtensionConfig::LoadExtensionSAEnable(const nlohmann::json &object,
     const std::string &extensionTypeName)
 {
     TAG_LOGD(AAFwkTag::ABILITYMGR, "LoadExtensionSAEnable call");
-    if (!object.contains(EXTENSION_SA_ENABLE_FLAG) || !object.at(EXTENSION_SA_ENABLE_FLAG).is_boolean()) {
+    if (!object.contains(SA_ACCESS_ENABLE_FLAG) || !object.at(SA_ACCESS_ENABLE_FLAG).is_boolean()) {
         TAG_LOGW(AAFwkTag::ABILITYMGR, "sa enable flag null");
         return;
     }
-    bool flag = object.at(EXTENSION_SA_ENABLE_FLAG).get<bool>();
+    bool flag = object.at(SA_ACCESS_ENABLE_FLAG).get<bool>();
     configMap_[extensionTypeName].saEnableFlag = flag;
     TAG_LOGD(AAFwkTag::ABILITYMGR, "The %{public}s extension's sa enable flag is %{public}d",
         extensionTypeName.c_str(), flag);
 }
 
+bool ExtensionConfig::HasAbilityAccess(const std::string &extensionTypeName)
+{
+    std::lock_guard lock(configMapMutex_);
+    auto iter = configMap_.find(extensionTypeName);
+    if (iter == configMap_.end()) {
+        return false;
+    }
+    return iter->second.hasAbilityAccess;
+}
+
+bool ExtensionConfig::HasThridPartyAppAccessFlag(const std::string &extensionTypeName)
+{
+    auto accessFlag = GetSingleAccessFlag(extensionTypeName, [](const AbilityAccessItem &abilityAccess) {
+        return abilityAccess.thirdPartyAppAccessFlag;
+    });
+    return accessFlag.has_value();
+}
+
+bool ExtensionConfig::HasServiceAccessFlag(const std::string &extensionTypeName)
+{
+    auto accessFlag = GetSingleAccessFlag(extensionTypeName, [](const AbilityAccessItem &abilityAccess) {
+        return abilityAccess.serviceAccessFlag;
+    });
+    return accessFlag.has_value();
+}
+
+bool ExtensionConfig::HasDefaultAccessFlag(const std::string &extensionTypeName)
+{
+    auto accessFlag = GetSingleAccessFlag(extensionTypeName, [](const AbilityAccessItem &abilityAccess) {
+        return abilityAccess.defaultAccessFlag;
+    });
+    return accessFlag.has_value();
+}
+
+std::optional<bool> ExtensionConfig::GetSingleAccessFlag(const std::string &extensionTypeName,
+    std::function<std::optional<bool>(const AbilityAccessItem&)> getAccessFlag)
+{
+    std::lock_guard lock(configMapMutex_);
+    auto iter = configMap_.find(extensionTypeName);
+    if (iter == configMap_.end()) {
+        return std::nullopt;
+    }
+    return getAccessFlag(iter->second.abilityAccess);
+}
+
+bool ExtensionConfig::IsExtensionStartThirdPartyAppEnableNew(const std::string &extensionTypeName,
+    const std::string &targetUri)
+{
+    return IsExtensionAbilityAccessEnable(extensionTypeName, targetUri, [](const AbilityAccessItem &abilityAccess) {
+        return abilityAccess.thirdPartyAppAccessFlag;
+    });
+}
+
+bool ExtensionConfig::IsExtensionStartServiceEnableNew(const std::string &extensionTypeName,
+    const std::string &targetUri)
+{
+    return IsExtensionAbilityAccessEnable(extensionTypeName, targetUri, [](const AbilityAccessItem &abilityAccess) {
+        return abilityAccess.serviceAccessFlag;
+    });
+}
+
+bool ExtensionConfig::IsExtensionStartDefaultEnable(const std::string &extensionTypeName, const std::string &targetUri)
+{
+    return IsExtensionAbilityAccessEnable(extensionTypeName, targetUri, [](const AbilityAccessItem &abilityAccess) {
+        return abilityAccess.defaultAccessFlag;
+    });
+}
+
+bool ExtensionConfig::IsExtensionAbilityAccessEnable(const std::string &extensionTypeName, const std::string &targetUri,
+    std::function<std::optional<bool>(const AbilityAccessItem&)> getAccessFlag)
+{
+    AbilityAccessItem abilityAccess;
+    {
+        std::lock_guard lock(configMapMutex_);
+        auto iter = configMap_.find(extensionTypeName);
+        if (iter == configMap_.end()) {
+            return true;
+        }
+        abilityAccess = iter->second.abilityAccess;
+    }
+    auto accessFlag = getAccessFlag(abilityAccess);
+    if (!accessFlag.has_value()) {
+        // flag not configured, allow access
+        return true;
+    }
+    AppExecFwk::ElementName targetElementName;
+    if (!targetElementName.ParseURI(targetUri)) {
+        return accessFlag.value();
+    }
+    if (accessFlag.value()) {
+        //flag true, deny access in block list
+        return !FindTargetUriInList(targetElementName, abilityAccess.blockList);
+    }
+    // flag false, allow access in allow list
+    return FindTargetUriInList(targetElementName, abilityAccess.allowList);
+}
+
+bool ExtensionConfig::FindTargetUriInList(const AppExecFwk::ElementName &targetElementName,
+    std::unordered_set<std::string> &list)
+{
+    return std::find_if(list.begin(), list.end(), [&](const auto &uri) {
+        AppExecFwk::ElementName iterElementName;
+        return iterElementName.ParseURI(uri) &&
+            iterElementName.GetBundleName() == targetElementName.GetBundleName() &&
+            iterElementName.GetAbilityName() == targetElementName.GetAbilityName();
+    }) != list.end();
+}
+
 bool ExtensionConfig::IsExtensionNetworkEnable(const std::string &extensionTypeName)
 {
     std::lock_guard lock(configMapMutex_);
@@ -265,7 +444,7 @@ bool ExtensionConfig::ReadFileInfoJson(const std::string &filePath, nlohmann::js
     return true;
 }
 
-bool ExtensionConfig::CheckServiceExtensionUriValid(const std::string &uri)
+bool ExtensionConfig::CheckExtensionUriValid(const std::string &uri)
 {
     const size_t memberNum = 4;
     if (std::count(uri.begin(), uri.end(), '/') != memberNum - 1) {

services/abilitymgr/src/interceptor/extension_control_interceptor.cpp

@@ -44,6 +44,15 @@ ErrCode ExtensionControlInterceptor::DoProcess(AbilityInterceptorParam param)
         return ERR_OK;
     }
 
+    if (!DelayedSingleton<ExtensionConfig>::GetInstance()->HasAbilityAccess(callerAbilityInfo.extensionTypeName)) {
+        return ProcessInterceptOld(param, targetAbilityInfo, callerAbilityInfo);
+    }
+    return ProcessInterceptNew(param, targetAbilityInfo, callerAbilityInfo);
+}
+
+int32_t ExtensionControlInterceptor::ProcessInterceptOld(const AbilityInterceptorParam& param,
+    const AppExecFwk::AbilityInfo &targetAbilityInfo, const AppExecFwk::AbilityInfo &callerAbilityInfo)
+{
     // check blocked list
     if (!targetAbilityInfo.applicationInfo.isSystemApp &&
         !DelayedSingleton<ExtensionConfig>::GetInstance()->IsExtensionStartThirdPartyAppEnable(
@@ -53,7 +62,7 @@ ErrCode ExtensionControlInterceptor::DoProcess(AbilityInterceptorParam param)
         return EXTENSION_BLOCKED_BY_THIRD_PARTY_APP_FLAG;
     }
     if ((targetAbilityInfo.extensionAbilityType == AppExecFwk::ExtensionAbilityType::SERVICE ||
-         targetAbilityInfo.extensionAbilityType == AppExecFwk::ExtensionAbilityType::DATASHARE) &&
+        targetAbilityInfo.extensionAbilityType == AppExecFwk::ExtensionAbilityType::DATASHARE) &&
         !DelayedSingleton<ExtensionConfig>::GetInstance()->IsExtensionStartServiceEnable(
             callerAbilityInfo.extensionTypeName, param.want.GetElement().GetURI())) {
         TAG_LOGE(AAFwkTag::ABILITYMGR, "service list block extension call, bundleName: %{public}s",
@@ -65,6 +74,50 @@ ErrCode ExtensionControlInterceptor::DoProcess(AbilityInterceptorParam param)
     return ERR_OK;
 }
 
+int32_t ExtensionControlInterceptor::ProcessInterceptNew(const AbilityInterceptorParam& param,
+    const AppExecFwk::AbilityInfo &targetAbilityInfo, const AppExecFwk::AbilityInfo &callerAbilityInfo)
+{
+    auto extensionConfig = DelayedSingleton<ExtensionConfig>::GetInstance();
+    if (!extensionConfig) {
+        TAG_LOGE(AAFwkTag::ABILITYMGR, "extensionConfig null");
+        return ERR_OK;
+    }
+
+    auto targetUri = param.want.GetElement().GetURI();
+    if (!targetAbilityInfo.applicationInfo.isSystemApp &&
+        extensionConfig->HasThridPartyAppAccessFlag(callerAbilityInfo.extensionTypeName)) {
+        if (!extensionConfig->IsExtensionStartThirdPartyAppEnableNew(callerAbilityInfo.extensionTypeName, targetUri)) {
+            TAG_LOGE(AAFwkTag::ABILITYMGR, "start third party app controlled by extension, bundleName: %{public}s",
+                callerAbilityInfo.bundleName.c_str());
+            return EXTENSION_BLOCKED_BY_THIRD_PARTY_APP_FLAG;
+        }
+        return ERR_OK;
+    }
+
+    auto isServiceOrDataShare = targetAbilityInfo.extensionAbilityType == AppExecFwk::ExtensionAbilityType::SERVICE ||
+        targetAbilityInfo.extensionAbilityType == AppExecFwk::ExtensionAbilityType::DATASHARE;
+    if (isServiceOrDataShare && extensionConfig->HasServiceAccessFlag(callerAbilityInfo.extensionTypeName)) {
+        if (!extensionConfig->IsExtensionStartServiceEnableNew(callerAbilityInfo.extensionTypeName, targetUri)) {
+            TAG_LOGE(AAFwkTag::ABILITYMGR,
+                "start service or datashare controlled by extension, bundleName: %{public}s",
+                callerAbilityInfo.bundleName.c_str());
+            return EXTENSION_BLOCKED_BY_SERVICE_LIST;
+        }
+        return ERR_OK;
+    }
+
+    if (extensionConfig->HasDefaultAccessFlag(callerAbilityInfo.extensionTypeName)) {
+        if (!extensionConfig->IsExtensionStartDefaultEnable(callerAbilityInfo.extensionTypeName, targetUri)) {
+            TAG_LOGE(AAFwkTag::ABILITYMGR, "start ability controlled by extension, bundleName: %{public}s",
+                callerAbilityInfo.bundleName.c_str());
+            return ERR_EXTENSION_START_ABILITY_CONTROLEED;
+        }
+        return ERR_OK;
+    }
+
+    return ERR_OK;
+}
+
 bool ExtensionControlInterceptor::GetCallerAbilityInfo(const AbilityInterceptorParam& param,
     AppExecFwk::AbilityInfo& callerAbilityInfo)
 {

services/common/include/json_utils.h

@@ -18,6 +18,7 @@
 
 #include <string>
 #include <map>
+#include <optional>
 
 #include "nlohmann/json.hpp"
 #include "singleton.h"
@@ -79,6 +80,15 @@ public:
      */
     bool IsEqual(nlohmann::json &jsonObject, const std::string &key, int32_t value);
 
+    /**
+     * parse json to optional bool.
+     *
+     * @param jsonObject The json object.
+     * @param key The key.
+     * @return optional boolean value.
+     */
+    std::optional<bool> JsonToOptionalBool(const nlohmann::json &jsonObject, const std::string &key);
+
 private:
     std::string GetConfigPath(const std::string& path, const std::string& defaultPath);
     bool ReadFileInfoJson(const std::string &filePath, nlohmann::json &jsonBuf);

services/common/src/json_utils.cpp

@@ -114,5 +114,13 @@ bool JsonUtils::IsEqual(nlohmann::json &jsonObject, const std::string &key, int3
     }
     return true;
 }
+
+std::optional<bool> JsonUtils::JsonToOptionalBool(const nlohmann::json &jsonObject, const std::string &key)
+{
+    if (jsonObject.contains(key) && jsonObject[key].is_boolean()) {
+        return jsonObject[key].get<bool>();
+    }
+    return std::nullopt;
+}
 }  // namespace AAFwk
 }  // namespace OHOS

test/fuzztest/extensionconfig_fuzzer/BUILD.gn

@@ -51,6 +51,7 @@ ohos_fuzztest("ExtensionConfigFuzzTest") {
     "${ability_runtime_native_path}/ability/native:abilitykit_native",
     "${ability_runtime_services_path}/abilitymgr:abilityms",
     "${ability_runtime_services_path}/abilitymgr:ams_configuration_parameter",
+    "${ability_runtime_services_path}/common:app_util",
   ]
 
   external_deps = [

test/fuzztest/extensionconfig_fuzzer/extensionconfig_fuzzer.cpp

@@ -54,6 +54,13 @@ bool DoSomethingInterestingWithMyAPI(const char *data, size_t size)
     extensionConfig->GetExtensionAutoDisconnectTime(strParam);
     extensionConfig->IsExtensionStartThirdPartyAppEnable(strParam);
     extensionConfig->IsExtensionStartServiceEnable(strParam, strParam);
+    extensionConfig->HasAbilityAccess(strParam);
+    extensionConfig->HasThridPartyAppAccessFlag(strParam);
+    extensionConfig->HasServiceAccessFlag(strParam);
+    extensionConfig->HasDefaultAccessFlag(strParam);
+    extensionConfig->IsExtensionStartServiceEnableNew(strParam, strParam);
+    extensionConfig->IsExtensionStartThirdPartyAppEnableNew(strParam, strParam);
+    extensionConfig->IsExtensionStartDefaultEnable(strParam, strParam);
     nlohmann::json object;
     extensionConfig->LoadExtensionConfig(object);
     extensionConfig->ReadFileInfoJson(strParam, object);
@@ -61,7 +68,8 @@ bool DoSomethingInterestingWithMyAPI(const char *data, size_t size)
     extensionConfig->LoadExtensionAutoDisconnectTime(object, strParam);
     extensionConfig->LoadExtensionThirdPartyAppBlockedList(object, strParam);
     extensionConfig->LoadExtensionServiceBlockedList(object, strParam);
-    extensionConfig->CheckServiceExtensionUriValid(strParam);
+    extensionConfig->LoadExtensionAbilityAccess(object, strParam);
+    extensionConfig->CheckExtensionUriValid(strParam);
     return true;
 }
 } // namespace OHOS

test/unittest/ability_extension_config_test/BUILD.gn

@@ -32,6 +32,7 @@ ohos_unittest("ability_extension_config_test") {
   deps = [
     "${ability_runtime_innerkits_path}/ability_manager:ability_manager",
     "${ability_runtime_services_path}/abilitymgr:abilityms",
+    "${ability_runtime_services_path}/common:app_util",
   ]
 
   external_deps = [