SHELL绕过invisible校验打点/hideSensitiveType非系统调用打点

Signed-off-by: lidongrui <lidongrui3@huawei.com>
Co-Authored-By: Agent

services/abilitymgr/src/utils/update_caller_info_util.cpp

@@ -21,6 +21,7 @@
 #include "accesstoken_kit.h"
 #include "app_scheduler.h"
 #include "ams_configuration_parameter.h"
+#include "event_report.h"
 #include "dialog_session_manager.h"
 #include "hilog_tag_wrapper.h"
 #include "hitrace_meter.h"
@@ -48,6 +49,7 @@ constexpr const char* COMPONENT_STARTUP_NEW_RULES = "component.startup.newRules"
 constexpr const char* SPECIFIED_ABILITY_FLAG = "ohos.ability.params.specifiedAbilityFlag";
 constexpr const char* SHELL_ASSISTANT_BUNDLENAME = "com.ohos.shell_assistant";
 constexpr const char* UIEXTENSION_TYPE_KEY = "ability.want.params.uiExtensionType";
+const std::string HIDE_SENSITIVE_TYPE = "ohos.media.params.hideSensitiveType";
 constexpr int32_t BROKER_UID = 5557;
 }
 
@@ -386,6 +388,23 @@ void UpdateCallerInfoUtil::ClearProtectedWantParam(Want &want)
         AbilityEventUtil::SendStartAbilityErrorEvent(eventInfo, AAFwk::ERR_NOT_EXPECTED_NATIVE_CALLER_NAME,
             std::string("no expected caller native name: ") + want.GetStringParam(Want::PARAM_RESV_CALLER_NATIVE_NAME));
     }
+    if (want.HasParameter(HIDE_SENSITIVE_TYPE)) {
+        EventInfo eventInfo;
+        std::string bundleName = want.GetElement().GetBundleName();
+        int32_t callerUid = IPCSkeleton::GetCallingUid();
+        std::string callerBundleName;
+        auto bundleMgr = AbilityUtil::GetBundleManagerHelper();
+        if (bundleMgr != nullptr) {
+            IN_PROCESS_CALL(bundleMgr->GetNameForUid(callerUid, callerBundleName));
+        }
+        if (callerBundleName.empty()) {
+            callerBundleName = std::to_string(callerUid);
+        }
+        auto hideSensitiveType = want.GetIntParam(HIDE_SENSITIVE_TYPE, 0);
+        eventInfo.uri = "HideSensitiveType://" + bundleName + "/" + callerBundleName + "/" +
+            std::to_string(hideSensitiveType);
+        EventReport::SendGrantUriPermissionEvent(EventName::GRANT_URI_PERMISSION, eventInfo);
+    }
     want.RemoveParam(Want::PARAM_RESV_CALLER_NATIVE_NAME);
     want.RemoveParam(COMPONENT_STARTUP_NEW_RULES);
     if (!PermissionVerification::GetInstance()->IsSystemAppCall()) {

services/common/BUILD.gn

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2024-2025 Huawei Device Co., Ltd.
+# Copyright (c) 2024-2026 Huawei Device Co., Ltd.
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -111,7 +111,10 @@ ohos_shared_library("perm_verification") {
 
   sources = [ "src/permission_verification.cpp" ]
 
-  deps = [ ":app_util" ]
+  deps = [
+    ":app_util",
+    ":hisysevent_report",
+  ]
 
   external_deps = [
     "ability_base:want",
@@ -119,6 +122,7 @@ ohos_shared_library("perm_verification") {
     "access_token:libtokenid_sdk",
     "c_utils:utils",
     "hilog:libhilog",
+    "hisysevent:libhisysevent",
     "hitrace:hitrace_meter",
     "init:libbegetutil",
     "ipc:ipc_core",
@@ -148,7 +152,10 @@ ohos_static_library("perm_verification_static") {
 
   sources = [ "src/permission_verification.cpp" ]
 
-  deps = [ ":app_util_static" ]
+  deps = [
+    ":app_util_static",
+    ":hisysevent_report_static",
+  ]
 
   external_deps = [
     "ability_base:want",
@@ -156,6 +163,7 @@ ohos_static_library("perm_verification_static") {
     "access_token:libtokenid_sdk",
     "c_utils:utils",
     "hilog:libhilog",
+    "hisysevent:libhisysevent",
     "hitrace:hitrace_meter",
     "init:libbegetutil",
     "ipc:ipc_core",

services/common/src/permission_verification.cpp

@@ -17,6 +17,7 @@
 
 #include "ability_manager_errors.h"
 #include "accesstoken_kit.h"
+#include "event_report.h"
 #include "hilog_tag_wrapper.h"
 #include "permission_constants.h"
 #include "server_constant.h"
@@ -432,6 +433,12 @@ int PermissionVerification::JudgeInvisibleAndBackground(const VerificationInfo &
     if (specifyTokenId == 0 &&
         SupportSystemAbilityPermission::IsSupportSaCallPermission()) {
         TAG_LOGD(AAFwkTag::DEFAULT, "Support SA call");
+        // Only report when: 1) shell call, 2) ability is invisible (exported=false)
+        if (IsShellCall() && !verificationInfo.visible) {
+            EventInfo eventInfo;
+            eventInfo.uri = "ShellCall://" + std::to_string(IPCSkeleton::GetCallingUid());
+            EventReport::SendGrantUriPermissionEvent(EventName::GRANT_URI_PERMISSION, eventInfo);
+        }
         return ERR_OK;
     }
     if (!isCallByShortcut &&

test/fuzztest/abilityfirstframestateobservermanager_fuzzer/BUILD.gn

@@ -65,6 +65,7 @@ ohos_fuzztest("AbilityFirstFrameStateObserverManagerFuzzTest") {
     "common_event_service:cesfwk_innerkits",
     "ffrt:libffrt",
     "hilog:libhilog",
+    "hisysevent:libhisysevent",
     "hitrace:hitrace_meter",
     "ipc:ipc_core",
     "napi:ace_napi",

test/unittest/update_caller_info_util_test/update_caller_info_util_test.cpp

@@ -37,6 +37,7 @@ namespace AAFwk {
 
 constexpr const char *CALLER_REQUEST_CODE = "ohos.extra.param.key.callerRequestCode";
 constexpr const char *DMS_CALLER_BUNDLE_NAME = "ohos.dms.param.sourceCallerBundleName";
+const std::string HIDE_SENSITIVE_TYPE = "ohos.media.params.hideSensitiveType";
 
 class UpdateCallerInfoUtilTest : public testing::Test {
 public:
@@ -665,5 +666,43 @@ HWTEST_F(UpdateCallerInfoUtilTest, UpdateCallerAppCloneIndex_0002, TestSize.Leve
     updateCallerUtil->UpdateCallerAppCloneIndex(want, zeroIndex);
     EXPECT_EQ(want.GetIntParam(Want::PARAM_RESV_CALLER_APP_CLONE_INDEX, -1), zeroIndex);
 }
+
+/**
+ * @tc.name: UpdateCallerInfoUtilTest_ClearProtectedWantParam_HideSensitiveType_001
+ * @tc.desc: Test ClearProtectedWantParam with HIDE_SENSITIVE_TYPE parameter
+ * @tc.type: FUNC
+ */
+HWTEST_F(UpdateCallerInfoUtilTest, ClearProtectedWantParam_HideSensitiveType_001, TestSize.Level1)
+{
+    auto updateCallerUtil = std::make_shared<UpdateCallerInfoUtil>();
+    Want want;
+    want.SetParam(HIDE_SENSITIVE_TYPE, 521);
+    want.SetElementName("com.test.demo", "entry", "TestAbility");
+
+    // ClearProtectedWantParam should trigger event for HIDE_SENSITIVE_TYPE
+    updateCallerUtil->ClearProtectedWantParam(want);
+
+    // Verify the parameter is processed (no exception thrown)
+    EXPECT_EQ(want.GetIntParam(HIDE_SENSITIVE_TYPE, -1), 521);
+}
+
+/**
+ * @tc.name: UpdateCallerInfoUtilTest_ClearProtectedWantParam_HideSensitiveType_002
+ * @tc.desc: Test ClearProtectedWantParam with HIDE_SENSITIVE_TYPE = 0
+ * @tc.type: FUNC
+ */
+HWTEST_F(UpdateCallerInfoUtilTest, ClearProtectedWantParam_HideSensitiveType_002, TestSize.Level1)
+{
+    auto updateCallerUtil = std::make_shared<UpdateCallerInfoUtil>();
+    Want want;
+    want.SetParam(HIDE_SENSITIVE_TYPE, 0);
+    want.SetElementName("com.test.demo", "entry", "TestAbility");
+
+    // ClearProtectedWantParam should still process the parameter
+    updateCallerUtil->ClearProtectedWantParam(want);
+
+    // Verify the parameter value
+    EXPECT_EQ(want.GetIntParam(HIDE_SENSITIVE_TYPE, -1), 0);
+}
 } // namespace AAFwk
 } // namespace OHOS