!19358 merge skill_perm_fix into master

fix: 修复ExecTool skill路径权限校验绕过及requestCode错误码 Created-by: RuiChen_01 Commit-by: RuiChen_01 Merged-by: openharmony_ci Description: **IssueNo**: **Description**: **稳定性自检：** | 自检项 | 自检结果 | | ------------------------------------------------------------ | -------- | | 涉及跨进程调用的相关操作需要抛至主线程或加锁防止并发 | | | 成员变量进行赋值或创建需要排查并发 | | | 谨慎在lambda表达式中使用引用捕获 | | | 谨慎在未经拷贝的情况下使用外部传入的string、C字符串 | | | map\vector\list\set等stl模板类使用时需要排查并发 | | | 谨慎考虑加锁范围 | | | 在IPC通信中谨慎使用同步通信方式 | | | 禁止传递this指针至其他模块或线程（特别是eventhandler任务） | | | 禁止将外部传入的裸指针在内部直接构造智能指针 | | | 禁止多个独立创建的智能指针管理同一地址 | | | 禁止在析构函数中抛异步任务 | | | 禁止js对象在非js线程（例如在IPC线程）创建、使用或销毁 | | | 禁止在对外接口中未经判空直接使用外部传入的指针 | | | 禁止接口返回局部变量引用 | | | 禁止在信号函数中加锁 | | | 禁止在关键流程（SA启动、应用启动等主流程）执行耗时的操作 | | | 禁止将同一个cpp编译在不同的so中 | | **安全编码自检：** | 自检项 | 自检结果 | | -------------------------------------------------------------- | -------- | | 裸指针避免通过隐式转换构造为sptr | | | json对象在取值之前必须先判断类型，避免类型不匹配 | | | 序列化时必须对传入的数组大小进行校验，避免出现超大数组 | | | 避免使用未明确位宽的整型，选择使用int8_t、uint8_t等类型 | | | 外部传入的路径要做规范化校验，对路径中的.、..、../等特殊字符严格校验 | | | 指针变量、表示资源描述符的变量、bool变量必须赋初值 | | | readParcelable获取的对象使用前需要判空 | | | 分配和释放内存的函数需要成对出现 | | | 申请内存后异常退出前需要及时进行内存释放 | | | 内存申请前必须对内存大小进行合法性校验 | | | 内存分配后必须判断是否成功 | | | 禁止使用realloc、alloca函数 | | | 禁止打印文件路径、口令等敏感信息，如有需要，使用private修饰 | | | 禁止打印内存地址 | | | 整数之间运算时必须严格检查，确保不会出现溢出、反转、除0 | | | 禁止对有符号整数进行位操作符运算 | | | 禁止对指针进行逻辑或位运算 | | | 循环次数如果收外部数据控制，需要检验其合法性 | | | 禁止使用内存操作类危险函数，需要使用安全函数 | | | 谨慎使用不可重入函数 | | | 必须检查安全函数的返回值，并进行正确处理 | | | 禁止仅通过TokenType类型判断绕过权限校验 | | **TDD Result**: **XTS Result**: ### 是否已执行L0用例 - [ ] 已验证 - [ ] 不涉及。如不涉及，请写明理由 See merge request: openharmony/ability_ability_runtime!19358
2026-08-25 12:23:20 -04:00 · 2026-05-17 11:44:24 +08:00
parent ee9d48bcd8 f927d64020
commit 8f7d120b1a
11 changed files with 246 additions and 49 deletions
@@ -26,7 +26,8 @@
                "ohos.permission.RUNNING_STATE_OBSERVER",
                "ohos.permission.MANAGE_SKILL_PRIVILEGE",
                "ohos.permission.PARENT_CONTROL_UI",
-                "ohos.permission.START_ABILITIES_FROM_BACKGROUND"
+                "ohos.permission.START_ABILITIES_FROM_BACKGROUND",
+                "ohos.permission.ABILITY_BACKGROUND_COMMUNICATION"
            ],
            "permission_acls" : [
                "ohos.permission.MANAGE_TOOL_TOKENID"
@@ -146,6 +146,8 @@ private:
    int32_t SetupAndStartSession(const ExecToolParam &param, const std::string &eventId,
        const ToolInfo &toolInfo, const std::string &sandboxConfig, const std::string &bundleName);

+    int32_t TryDispatchSkillSession(const ExecToolParam &param,
+        const std::string &eventId, const ToolInfo &toolInfo, bool &dispatched);
    int32_t SetupAndStartSkillSession(const ExecToolParam &param,
        const std::string &eventId, const ToolInfo &toolInfo);
    int32_t ValidateSkillTypeFromParam(const ExecToolParam &param, int32_t &skillType);
@@ -48,7 +48,6 @@ constexpr int32_t QUERY_DB_ERROR = 2;
 constexpr int32_t MAX_QUERY_CMDS_SIZE = 100;
 constexpr int32_t ACTIVE_TIME = 30 * 1000; // 30s
 constexpr int32_t SKILL_TYPE_INDEPENDENT = -1;
-sptr<SkillCallbackAdapter> adaptor_;
 } // namespace

 std::mutex g_mutex;
@@ -552,45 +551,63 @@ void CliToolManagerService::HandleBackgroundSessionReply(
    EventDispatcher::GetInstance().DispatchExecToolReplyEvent(record->callerPid, eventId, ERR_OK, session);
 }

+int32_t CliToolManagerService::TryDispatchSkillSession(const ExecToolParam &param,
+    const std::string &eventId, const ToolInfo &toolInfo, bool &dispatched)
+{
+    dispatched = false;
+    if (!ToolUtil::IsSkillTool(param.toolName)) {
+        return ERR_OK;
+    }
+
+    int32_t skillType = 0;
+    auto skillRet = ValidateSkillTypeFromParam(param, skillType);
+    if (skillRet != ERR_OK) {
+        return skillRet;
+    }
+    if (skillType == SKILL_TYPE_INDEPENDENT) {
+        TAG_LOGI(AAFwkTag::CLI_TOOL,
+            "Independent skill, fallback to CLI path, toolName=%{public}s", param.toolName.c_str());
+        return ERR_OK;
+    }
+
+    TAG_LOGI(AAFwkTag::CLI_TOOL,
+        "Dispatch to skill path, toolName=%{public}s eventId=%{public}s",
+        param.toolName.c_str(), eventId.c_str());
+    dispatched = true;
+    int32_t ret = SetupAndStartSkillSession(param, eventId, toolInfo);
+    if (ret != ERR_OK) {
+        TAG_LOGE(AAFwkTag::CLI_TOOL,
+            "Skill dispatch failed, toolName=%{public}s ret=%{public}d", param.toolName.c_str(), ret);
+    }
+    return ret;
+}
+
 int32_t CliToolManagerService::ExecTool(const ExecToolParam &param, const std::string &eventId)
 {
    InterfaceCallCounter counter(interfaceCalledCount_);
    TAG_LOGI(AAFwkTag::CLI_TOOL, "ExecTool called: toolName=%{public}s, subcommand=%{public}s",
        param.toolName.c_str(), param.subcommand.c_str());
-    ToolInfo toolInfo;
-    if (ToolUtil::IsSkillTool(param.toolName)) {
-        int32_t skillType = 0;
-        auto skillRet = ValidateSkillTypeFromParam(param, skillType);
-        if (skillRet == ERR_OK && skillType != SKILL_TYPE_INDEPENDENT) {
-            TAG_LOGI(AAFwkTag::CLI_TOOL,
-                "Dispatch to skill path, toolName=%{public}s eventId=%{public}s",
-                param.toolName.c_str(), eventId.c_str());
-            int32_t ret = SetupAndStartSkillSession(param, eventId, toolInfo);
-            if (ret != ERR_OK) {
-                TAG_LOGE(AAFwkTag::CLI_TOOL,
-                    "Skill dispatch failed, toolName=%{public}s ret=%{public}d", param.toolName.c_str(), ret);
-            }
-            return ret;
-        }
-        if (skillRet != ERR_OK) {
-            return skillRet;
-        }
-        TAG_LOGI(AAFwkTag::CLI_TOOL,
-            "Independent skill, fallback to CLI path, toolName=%{public}s", param.toolName.c_str());
-    }
-
    if (auto ret = ValidateExecToolPermissions(); ret != ERR_OK) {
        return ret;
    }
+
+    ToolInfo toolInfo;
+    bool dispatched = false;
+    auto skillRet = TryDispatchSkillSession(param, eventId, toolInfo, dispatched);
+    if (skillRet != ERR_OK) {
+        return skillRet;
+    }
+    if (dispatched) {
+        return ERR_OK;
+    }
+
    if (auto ret = ValidateSessionLimit(); ret != ERR_OK) {
        return ret;
    }

    auto tokenId = IPCSkeleton::GetCallingTokenID();
-
    std::string sandboxConfig;
    std::string bundleName;
-
    if (auto ret = ValidateAndPrepareTool(param, tokenId, toolInfo, sandboxConfig, bundleName); ret != ERR_OK) {
        return ret;
    }
@@ -1030,7 +1047,7 @@ int32_t CliToolManagerService::SetupAndStartSkillSession(const ExecToolParam &pa
    AddSessionRecord(record);

    auto callerTokenId = IPCSkeleton::GetCallingTokenID();
-    adaptor_ = sptr<SkillCallbackAdapter>::MakeSptr(
+    auto adaptor = sptr<SkillCallbackAdapter>::MakeSptr(
        record->sessionId, record->callerPid, eventId);

    AppExecFwk::SkillExecuteRequest skillRequest;
@@ -1044,7 +1061,7 @@ int32_t CliToolManagerService::SetupAndStartSkillSession(const ExecToolParam &pa

    TAG_LOGD(AAFwkTag::CLI_TOOL, "execSkill before ExecuteInAppSkillWithTokenId");
    int32_t ret = AAFwk::AbilityManagerClient::GetInstance()->ExecuteInAppSkillWithTokenId(
-        skillRequest, adaptor_);
+        skillRequest, adaptor);
    if (ret != ERR_OK) {
        TAG_LOGE(AAFwkTag::CLI_TOOL, "ExecuteInAppSkillWithTokenId failed:%{public}d", ret);
        RemoveSessionRecord(record->sessionId);
@@ -2515,32 +2515,70 @@ void JsUIAbility::NotifyWindowDestroy()
    }
 }

+namespace {
+std::string ExtractBaseName(const std::string &path)
+{
+    auto slashPos = path.rfind('/');
+    auto dotPos = path.rfind('.');
+    if (slashPos == std::string::npos) {
+        slashPos = 0;
+    } else {
+        slashPos++;
+    }
+    if (dotPos == std::string::npos || dotPos <= slashPos) {
+        return path.substr(slashPos);
+    }
+    return path.substr(slashPos, dotPos - slashPos);
+}
+} // namespace
+
 napi_value JsUIAbility::LoadSkillFunction(
    const std::shared_ptr<AppExecFwk::SkillExecuteParam> &param, napi_value &outJsObj)
 {
    napi_env env = jsRuntime_.GetNapiEnv();
-    std::unique_ptr<NativeReference> moduleRef = nullptr;
    napi_value method = nullptr;
-    for (const auto &srcEntry : param->srcEntries_) {
+
+    auto TryLoadEntry = [&](const std::string &srcEntry) -> bool {
        std::string srcPath(param->moduleName_ + "/" + srcEntry);
        auto pos = srcPath.rfind('.');
        if (pos == std::string::npos) {
            TAG_LOGW(AAFwkTag::UIABILITY, "skip srcEntry, no extension:%{public}s", srcEntry.c_str());
-            continue;
+            return false;
        }
        srcPath.erase(pos);
        srcPath.append(".abc");
-        moduleRef = jsRuntime_.LoadModule(param->moduleName_, srcPath, param->hapPath_, true);
-        if (moduleRef == nullptr) {
+        skillModuleRef_ = jsRuntime_.LoadModule(param->moduleName_, srcPath, param->hapPath_, true);
+        if (skillModuleRef_ == nullptr) {
            TAG_LOGW(AAFwkTag::UIABILITY, "LoadModule failed, path:%{public}s", srcPath.c_str());
-            continue;
+            return false;
        }
-        outJsObj = moduleRef->GetNapiValue();
+        outJsObj = skillModuleRef_->GetNapiValue();
        method = AppExecFwk::GetPropertyValueByPropertyName(
            env, outJsObj, param->functionName_.c_str(), napi_valuetype::napi_function);
-        if (method != nullptr) {
+        return method != nullptr;
+    };
+
+    if (!param->scriptPath_.empty()) {
+        auto scriptBase = ExtractBaseName(param->scriptPath_);
+        for (const auto &srcEntry : param->srcEntries_) {
+            if (ExtractBaseName(srcEntry) != scriptBase) {
+                continue;
+            }
+            if (TryLoadEntry(srcEntry)) {
+                TAG_LOGI(AAFwkTag::UIABILITY,
+                    "func found via scriptPath match, srcEntry:%{public}s", srcEntry.c_str());
+                return method;
+            }
+        }
+        TAG_LOGW(AAFwkTag::UIABILITY,
+            "scriptPath match failed, fallback to full scan, scriptPath:%{public}s",
+            param->scriptPath_.c_str());
+    }
+
+    for (const auto &srcEntry : param->srcEntries_) {
+        if (TryLoadEntry(srcEntry)) {
            TAG_LOGI(AAFwkTag::UIABILITY, "func found in srcEntry:%{public}s", srcEntry.c_str());
-            break;
+            return method;
        }
        TAG_LOGW(AAFwkTag::UIABILITY, "func not found:%{public}s in srcEntry:%{public}s",
            param->functionName_.c_str(), srcEntry.c_str());
@@ -2567,6 +2605,10 @@ std::vector<napi_value> JsUIAbility::BuildSkillCallArgs(napi_env env,
    if (param->skillArgs_ != nullptr && !param->skillArgs_->GetParams().empty()) {
        napi_value wrappedObj = AppExecFwk::WrapWantParams(env, *param->skillArgs_);
        for (const auto &[key, value] : param->skillArgs_->GetParams()) {
+            auto typeId = AppExecFwk::WantParams::GetDataType(value);
+            auto valStr = AppExecFwk::WantParams::GetStringByType(value, typeId);
+            TAG_LOGI(AAFwkTag::UIABILITY, "skillArg key:%{public}s value:%{public}s",
+                key.c_str(), valStr.c_str());
            napi_value val = nullptr;
            napi_get_named_property(env, wrappedObj, key.c_str(), &val);
            args.push_back(val);
@@ -579,32 +579,70 @@ bool JsServiceExtension::HandleExecuteSkill(const AAFwk::Want &want)
    return true;
 }

+namespace {
+std::string ExtractBaseName(const std::string &path)
+{
+    auto slashPos = path.rfind('/');
+    auto dotPos = path.rfind('.');
+    if (slashPos == std::string::npos) {
+        slashPos = 0;
+    } else {
+        slashPos++;
+    }
+    if (dotPos == std::string::npos || dotPos <= slashPos) {
+        return path.substr(slashPos);
+    }
+    return path.substr(slashPos, dotPos - slashPos);
+}
+} // namespace
+
 napi_value JsServiceExtension::LoadSkillFunction(
    const std::shared_ptr<AppExecFwk::SkillExecuteParam> &param, napi_value &outJsObj)
 {
    napi_env env = jsRuntime_.GetNapiEnv();
-    std::unique_ptr<NativeReference> moduleRef = nullptr;
    napi_value method = nullptr;
-    for (const auto &srcEntry : param->srcEntries_) {
+
+    auto TryLoadEntry = [&](const std::string &srcEntry) -> bool {
        std::string srcPath(param->moduleName_ + "/" + srcEntry);
        auto pos = srcPath.rfind('.');
        if (pos == std::string::npos) {
            TAG_LOGW(AAFwkTag::SERVICE_EXT, "skip srcEntry, no extension:%{public}s", srcEntry.c_str());
-            continue;
+            return false;
        }
        srcPath.erase(pos);
        srcPath.append(".abc");
-        moduleRef = jsRuntime_.LoadModule(param->moduleName_, srcPath, param->hapPath_, true);
-        if (moduleRef == nullptr) {
+        skillModuleRef_ = jsRuntime_.LoadModule(param->moduleName_, srcPath, param->hapPath_, true);
+        if (skillModuleRef_ == nullptr) {
            TAG_LOGW(AAFwkTag::SERVICE_EXT, "LoadModule failed, path:%{public}s", srcPath.c_str());
-            continue;
+            return false;
        }
-        outJsObj = moduleRef->GetNapiValue();
+        outJsObj = skillModuleRef_->GetNapiValue();
        method = AppExecFwk::GetPropertyValueByPropertyName(
            env, outJsObj, param->functionName_.c_str(), napi_valuetype::napi_function);
-        if (method != nullptr) {
+        return method != nullptr;
+    };
+
+    if (!param->scriptPath_.empty()) {
+        auto scriptBase = ExtractBaseName(param->scriptPath_);
+        for (const auto &srcEntry : param->srcEntries_) {
+            if (ExtractBaseName(srcEntry) != scriptBase) {
+                continue;
+            }
+            if (TryLoadEntry(srcEntry)) {
+                TAG_LOGI(AAFwkTag::SERVICE_EXT,
+                    "func found via scriptPath match, srcEntry:%{public}s", srcEntry.c_str());
+                return method;
+            }
+        }
+        TAG_LOGW(AAFwkTag::SERVICE_EXT,
+            "scriptPath match failed, fallback to full scan, scriptPath:%{public}s",
+            param->scriptPath_.c_str());
+    }
+
+    for (const auto &srcEntry : param->srcEntries_) {
+        if (TryLoadEntry(srcEntry)) {
            TAG_LOGI(AAFwkTag::SERVICE_EXT, "func found in srcEntry:%{public}s", srcEntry.c_str());
-            break;
+            return method;
        }
        TAG_LOGW(AAFwkTag::SERVICE_EXT, "func not found:%{public}s in srcEntry:%{public}s",
            param->functionName_.c_str(), srcEntry.c_str());
@@ -615,7 +653,6 @@ napi_value JsServiceExtension::LoadSkillFunction(
 std::vector<napi_value> JsServiceExtension::BuildSkillCallArgs(napi_env env,
    const std::shared_ptr<AppExecFwk::SkillExecuteParam> &param)
 {
-    TAG_LOGI(AAFwkTag::SERVICE_EXT, "execSkill CallFunc inputArgs:%{public}s", param->skillArgs_->ToString().c_str());
    napi_value info = nullptr;
    napi_create_object(env, &info);
    napi_value requestCodeVal = nullptr;
@@ -632,6 +669,10 @@ std::vector<napi_value> JsServiceExtension::BuildSkillCallArgs(napi_env env,
    if (param->skillArgs_ != nullptr && !param->skillArgs_->GetParams().empty()) {
        napi_value wrappedObj = AppExecFwk::WrapWantParams(env, *param->skillArgs_);
        for (const auto &[key, value] : param->skillArgs_->GetParams()) {
+            auto typeId = AppExecFwk::WantParams::GetDataType(value);
+            auto valStr = AppExecFwk::WantParams::GetStringByType(value, typeId);
+            TAG_LOGI(AAFwkTag::SERVICE_EXT, "skillArg key:%{public}s value:%{public}s",
+                key.c_str(), valStr.c_str());
            napi_value val = nullptr;
            napi_get_named_property(env, wrappedObj, key.c_str(), &val);
            args.push_back(val);
@@ -462,6 +462,7 @@ private:
    JsRuntime &jsRuntime_;
    std::shared_ptr<NativeReference> shellContextRef_;
    std::shared_ptr<NativeReference> jsAbilityObj_;
+    std::unique_ptr<NativeReference> skillModuleRef_;
    sptr<IRemoteObject> remoteCallee_;
    bool reusingWindow_ = false;
    bool isGamePreLaunch_  = false;
@@ -200,6 +200,7 @@ private:
    std::unique_ptr<NativeReference> jsObj_;
    std::shared_ptr<NativeReference> shellContextRef_ = nullptr;
    std::shared_ptr<AbilityHandler> handler_ = nullptr;
+    std::unique_ptr<NativeReference> skillModuleRef_;

 #ifdef SUPPORT_GRAPHICS
 protected:
@@ -8377,7 +8377,7 @@ int32_t AbilityManagerProxy::ExecuteSkillDone(const sptr<IRemoteObject> &token,
        return INNER_ERR;
    }
    MessageParcel reply;
-    MessageOption option(MessageOption::TF_ASYNC);
+    MessageOption option;
    auto ret = SendRequest(AbilityManagerInterfaceCode::EXECUTE_SKILL_DONE_WITH_TOKEN, data, reply, option);
    if (ret != NO_ERROR) {
        TAG_LOGE(AAFwkTag::ABILITYMGR, "request fail:%{public}d", ret);
@@ -180,7 +180,7 @@ int32_t SkillExecuteManager::ExecuteSkillDone(const std::string &requestCode, in
    auto it = records_.find(requestCode);
    if (it == records_.end()) {
        TAG_LOGE(AAFwkTag::ABILITYMGR, "record not found, requestCode:%{public}s", requestCode.c_str());
-        return ERR_INVALID_VALUE;
+        return ERR_CODE_INVALID_ID;
    }

    auto record = it->second;
@@ -1528,5 +1528,95 @@ HWTEST_F(AbilityManagerClientBranchThirdTest, QuerySkillType_0200, TestSize.Leve
    auto ret = client_->QuerySkillType("bundle", "module", "skill", skillType);
    EXPECT_EQ(ret, ERR_OK);
 }
+
+/**
+ * @tc.name: ExecuteInAppSkillWithTokenId_0100
+ * @tc.desc: Test ExecuteInAppSkillWithTokenId with proxy not connected
+ * @tc.type: FUNC
+ */
+HWTEST_F(AbilityManagerClientBranchThirdTest, ExecuteInAppSkillWithTokenId_0100, TestSize.Level1)
+{
+    client_->proxy_ = nullptr;
+    EXPECT_CALL(Rosen::SceneBoardJudgement::GetInstance(), MockIsSceneBoardEnabled())
+        .WillRepeatedly(testing::Return(false));
+    EXPECT_CALL(*mockSystemAbility_, GetSystemAbility(testing::_)).WillRepeatedly(Return(nullptr));
+    SystemAbilityManagerClient::GetInstance().systemAbilityManager_ = mockSystemAbility_;
+
+    AppExecFwk::SkillExecuteRequest request;
+    auto ret = client_->ExecuteInAppSkillWithTokenId(request, nullptr);
+    EXPECT_EQ(ret, ABILITY_SERVICE_NOT_CONNECTED);
+}
+
+/**
+ * @tc.name: ExecuteInAppSkillWithTokenId_0200
+ * @tc.desc: Test ExecuteInAppSkillWithTokenId with proxy connected and success
+ * @tc.type: FUNC
+ */
+HWTEST_F(AbilityManagerClientBranchThirdTest, ExecuteInAppSkillWithTokenId_0200, TestSize.Level1)
+{
+    client_->proxy_ = mock_;
+    AppExecFwk::SkillExecuteRequest request;
+    sptr<ISkillExecuteCallback> callback = nullptr;
+    EXPECT_CALL(*mock_, ExecuteInAppSkillWithTokenId(_, _))
+        .Times(1)
+        .WillOnce(Return(ERR_OK));
+    auto ret = client_->ExecuteInAppSkillWithTokenId(request, callback);
+    EXPECT_EQ(ret, ERR_OK);
+}
+
+/**
+ * @tc.name: ExecuteInAppSkillWithTokenId_0300
+ * @tc.desc: Test ExecuteInAppSkillWithTokenId with proxy returns error
+ * @tc.type: FUNC
+ */
+HWTEST_F(AbilityManagerClientBranchThirdTest, ExecuteInAppSkillWithTokenId_0300, TestSize.Level1)
+{
+    client_->proxy_ = mock_;
+    AppExecFwk::SkillExecuteRequest request;
+    sptr<ISkillExecuteCallback> callback = nullptr;
+    EXPECT_CALL(*mock_, ExecuteInAppSkillWithTokenId(_, _))
+        .Times(1)
+        .WillOnce(Return(ERR_CODE_INVALID_ID));
+    auto ret = client_->ExecuteInAppSkillWithTokenId(request, callback);
+    EXPECT_EQ(ret, ERR_CODE_INVALID_ID);
+}
+
+/**
+ * @tc.name: ExecuteIntentWithResult_0100
+ * @tc.desc: Test ExecuteIntentWithResult with proxy not connected
+ * @tc.type: FUNC
+ */
+HWTEST_F(AbilityManagerClientBranchThirdTest, ExecuteIntentWithResult_0100, TestSize.Level1)
+{
+    client_->proxy_ = nullptr;
+    EXPECT_CALL(Rosen::SceneBoardJudgement::GetInstance(), MockIsSceneBoardEnabled())
+        .WillRepeatedly(testing::Return(false));
+    EXPECT_CALL(*mockSystemAbility_, GetSystemAbility(testing::_)).WillRepeatedly(Return(nullptr));
+    SystemAbilityManagerClient::GetInstance().systemAbilityManager_ = mockSystemAbility_;
+
+    InsightIntentExecuteParam param;
+    InsightIntentExecuteResult result;
+    auto ret = client_->ExecuteIntentWithResult(param, result, 1000);
+    EXPECT_EQ(ret, ABILITY_SERVICE_NOT_CONNECTED);
+}
+
+/**
+ * @tc.name: ExecuteIntentWithResult_0200
+ * @tc.desc: Test ExecuteIntentWithResult with ExecuteIntent returning error
+ * @tc.type: FUNC
+ */
+HWTEST_F(AbilityManagerClientBranchThirdTest, ExecuteIntentWithResult_0200, TestSize.Level1)
+{
+    client_->proxy_ = mock_;
+    EXPECT_CALL(*mock_, ExecuteIntent(_, _, _))
+        .Times(1)
+        .WillOnce(Return(ERR_INVALID_VALUE));
+
+    InsightIntentExecuteParam param;
+    InsightIntentExecuteResult result;
+    auto ret = client_->ExecuteIntentWithResult(param, result, 1000);
+    EXPECT_EQ(ret, ERR_INVALID_VALUE);
+}
+
 }  // namespace AAFwk
 }  // namespace OHOS
@@ -440,6 +440,8 @@ public:
        int32_t, const AppExecFwk::SkillExecuteResult &));
    MOCK_METHOD4(QuerySkillType, int32_t(const std::string &, const std::string &,
        const std::string &, int32_t &));
+    MOCK_METHOD2(ExecuteInAppSkillWithTokenId, int32_t(const AppExecFwk::SkillExecuteRequest &,
+        const sptr<ISkillExecuteCallback> &));
 };  // namespace AAFwk
 }   // namespace OHOS
 }