ability_ability_runtime

mirror of https://github.com/openharmony/ability_ability_runtime.git synced 2026-08-24 22:21:36 -04:00

T

RuiChen_01 0791b8eef0 refactor(skill): carry callerTokenId via AbilityRequest instead of Want

Permission checks (CheckStaticCfgPermission,
CheckCallServiceExtensionPermission, CheckStartByCallPermission) used to
read SKILL_EXECUTE_PARAM_CALLER_TOKEN_ID straight out of the Want that
flows through GenerateAbilityRequest. Because Want is attacker
controlled on the public StartAbility paths, a forged callerTokenId
could route the skill-specific permission branches in
PermissionVerification (CheckSkillStartByCallPermission,
JudgeInvisibleAndBackground) and borrow another app's identity.

Add a dedicated AbilityRequest::skillCallerTokenId field populated
solely by the trusted skill entrypoints:
- ExecuteInAppSkill / ExecuteInAppSkillWithTokenId drop the
  want.SetParam calls and pass callerTokenId through to
  StartAbilityByCallWithSkill / StartExtensionAbilityWithSkill.
- Those two helpers (and StartExtensionAbilityInner via a new optional
  parameter) set the AbilityRequest field after the request is
  generated.
- The three permission checks now read abilityRequest.skillCallerTokenId
  instead of the Want.

Forged Want params no longer influence permission decisions. Existing
callers of StartExtensionAbilityInner are unaffected via the default
parameter value.

Co-Authored-By: Agent
Signed-off-by: RuiChen_01 <chenrui193@huawei.com>

🤖‍ AI[100%] 👌 AI Adopted[100%] 🧑 Human[0%]
Co-authored-by: claude (glm-5.2) <ai@local>

2026-06-19 18:40:52 +08:00