!3694 merge master_publish_form into master

[校验] RequestPublishFormCrossUser 补充参数校验 #3033

Created-by: xiangcong3
Commit-by: xiangcong3
Merged-by: openharmony_ci
Description: 关联 Issue: #3033

## 变更概述

为 RequestPublishFormCrossUser 补充参数校验，当前 CrossUser 路径仅有权限校验，缺少卡片五元组参数校验（bundleName, moduleName, abilityName, formName, dimensionId）。

### 主要变更

1. **新增 `ValidatePublishFormParamsForCrossUser`** — CrossUser 整体校验入口，串联 ValidateParamsForCrossUser + ValidateFormInfoMatchForCrossUser
2. **新增 `ValidateParamsForCrossUser(const Want &want)`** — 纯校验（无输出参数赋值），校验 5 项：bundleName(GetElement)+moduleName(GetStringParam)+abilityName(GetElement)+formName(GetStringParam) 非空 + dimensionId 存在性(HasParameter)
3. **新增 `ValidateFormInfoMatchForCrossUser(const Want &want, int32_t userId)`** — 从 want 直接取值，GetFormsInfoByModuleWithoutCheck 查卡片数据 + abilityName+formName+dimensionId 五元组匹配
4. **isTemporary 强制 false** — 在 RequestPublishFormCrossUser 入口方法中处理，validate 不修改 want

### 校验设计要点

| 项目 | 决策 |
|---|---|
| bundleName/abilityName | `want.GetElement()` — 卡片提供方信息 |
| moduleName/formName | `want.GetStringParam()` |
| dimensionId 存在性 | `want.HasParameter()` — 缺省报错（策略A，与SDK一致） |
| 应用已安装校验 | 不做 — GetFormsInfoByModuleWithoutCheck 返回失败隐含不存在 |
| 独立校验链 | 不复用 CheckPublishForm |
| validate 只校验不修改 | isTemporary 在入口方法处理，validate 不赋值输出参数 |
| 校验粒度 | 2步 — ValidateParamsForCrossUser(五元组非空/存在性) → ValidateFormInfoMatchForCrossUser(卡片数据匹配) |

### 规格约束

- IPC 接口签名不变
- CrossUser 仅补充参数校验，不增加/删除原有逻辑
- 新增方法全部是 FormPublishAdapter private，不影响外部接口
- 业务编译 ✅ 通过

See merge request: openharmony/ability_form_fwk!3694

interfaces/inner_api/include/form_mgr_errors.h

@@ -126,7 +126,7 @@ enum {
     ERR_APPEXECFWK_FORM_LOCATION_INVALID,
     ERR_APPEXECFWK_FORM_PERMISSION_DENY_CUSTOM_CONFIG,
     ERR_APPEXECFWK_CONNECT_PROVIDER_TIMEOUT,
-    ERR_APPEXECFWK_FORM_RDB_CORRUPTION
+    ERR_APPEXECFWK_FORM_RDB_CORRUPTION, // 2293855
 };
 
 // External Error Code

interfaces/kits/native/src/form_mgr.cpp

@@ -634,7 +634,7 @@ ErrCode FormMgr::RequestPublishFormCrossUser(Want &want, int32_t userId, int64_t
     std::string bundleName = want.GetElement().GetBundleName();
     std::string abilityName = want.GetElement().GetAbilityName();
     if (bundleName.empty() || abilityName.empty()) {
-        HILOG_ERROR("bundleName:%{public}s,abilityName:%{public}s",
+        HILOG_ERROR("Param invalid, bundleName:%{public}s,abilityName:%{public}s",
             bundleName.c_str(), abilityName.c_str());
         return ERR_APPEXECFWK_FORM_INVALID_PARAM;
     }
@@ -642,12 +642,12 @@ ErrCode FormMgr::RequestPublishFormCrossUser(Want &want, int32_t userId, int64_t
     std::string moduleName = want.GetStringParam(Constants::PARAM_MODULE_NAME_KEY);
     int32_t dimensionId = want.GetIntParam(Constants::PARAM_FORM_DIMENSION_KEY, 0);
     if (formName.empty() || moduleName.empty() || dimensionId == 0) {
-        HILOG_ERROR("formName:%{public}s,moduleName:%{public}s,dimensionId:%{public}d",
+        HILOG_ERROR("Param invalid, formName:%{public}s,moduleName:%{public}s,dimensionId:%{public}d",
             formName.c_str(), moduleName.c_str(), dimensionId);
         return ERR_APPEXECFWK_FORM_INVALID_PARAM;
     }
     if (userId == Constants::INVALID_USER_ID) {
-        HILOG_ERROR("invalid userId:%{public}d", userId);
+        HILOG_ERROR("Param invalid, userId:%{public}d", userId);
         return ERR_APPEXECFWK_FORM_INVALID_PARAM;
     }
 

services/include/form_mgr/form_publish_adapter.h

@@ -100,6 +100,9 @@ private:
     ErrCode RequestPublishFormToHost(Want &want, int32_t userId);
     int32_t GetCallerType(const std::string &bundleName);
     bool GetBundleName(std::string &bundleName, bool needCheckFormPermission = true);
+    ErrCode ValidatePublishFormParamsForCrossUser(const Want &want, int32_t userId);
+    ErrCode ValidateParamsForCrossUser(const Want &want);
+    ErrCode ValidateFormInfoMatchForCrossUser(const Want &want, int32_t userId);
 
     std::unique_ptr<FormSerialQueue> serialQueue_;
     std::map<int64_t, AddFormResultErrorCodes> formIdMap_;

services/src/form_mgr/form_publish_adapter.cpp

@@ -565,7 +565,20 @@ ErrCode FormPublishAdapter::RequestPublishFormCrossUser(Want &want, int32_t user
 {
     HILOG_INFO("RequestPublishFormCrossUser called, userId:%{public}d", userId);
 
-    ErrCode errCode = RequestPublishFormCommon(want, userId, formId);
+    ErrCode errCode = ValidatePublishFormParamsForCrossUser(want, userId);
+    if (errCode != ERR_OK) {
+        HILOG_ERROR("ValidatePublishFormParamsForCrossUser failed");
+        return errCode;
+    }
+
+    // Published form should not be temporary
+    bool isTemporary = want.GetBoolParam(Constants::PARAM_FORM_TEMPORARY_KEY, false);
+    if (isTemporary) {
+        HILOG_WARN("The published form should not be temp");
+        want.SetParam(Constants::PARAM_FORM_TEMPORARY_KEY, false);
+    }
+
+    errCode = RequestPublishFormCommon(want, userId, formId);
     if (errCode != ERR_OK) {
         HILOG_ERROR("RequestPublishFormCommon failed");
         return errCode;
@@ -665,5 +678,75 @@ void FormPublishAdapter::RemoveFormIdMapElement(const int64_t formId)
     }
 }
 
+ErrCode FormPublishAdapter::ValidatePublishFormParamsForCrossUser(const Want &want, int32_t userId)
+{
+    ErrCode errCode = ValidateParamsForCrossUser(want);
+    if (errCode != ERR_OK) {
+        return errCode;
+    }
+
+    return ValidateFormInfoMatchForCrossUser(want, userId);
+}
+
+ErrCode FormPublishAdapter::ValidateParamsForCrossUser(const Want &want)
+{
+    if (want.GetElement().GetBundleName().empty()) {
+        HILOG_ERROR("Param invalid, bundleName is empty");
+        return ERR_APPEXECFWK_FORM_INVALID_PARAM;
+    }
+
+    if (want.GetStringParam(Constants::PARAM_MODULE_NAME_KEY).empty()) {
+        HILOG_ERROR("Param invalid, moduleName is empty");
+        return ERR_APPEXECFWK_FORM_INVALID_PARAM;
+    }
+
+    if (want.GetElement().GetAbilityName().empty()) {
+        HILOG_ERROR("Param invalid, abilityName is empty");
+        return ERR_APPEXECFWK_FORM_INVALID_PARAM;
+    }
+
+    if (want.GetStringParam(Constants::PARAM_FORM_NAME_KEY).empty()) {
+        HILOG_ERROR("Param invalid, formName is empty");
+        return ERR_APPEXECFWK_FORM_INVALID_PARAM;
+    }
+
+    if (!want.HasParameter(Constants::PARAM_FORM_DIMENSION_KEY)) {
+        HILOG_ERROR("Param invalid, dimensionId is not set");
+        return ERR_APPEXECFWK_FORM_INVALID_PARAM;
+    }
+
+    return ERR_OK;
+}
+
+ErrCode FormPublishAdapter::ValidateFormInfoMatchForCrossUser(const Want &want, int32_t userId)
+{
+    std::string bundleName = want.GetElement().GetBundleName();
+    std::string moduleName = want.GetStringParam(Constants::PARAM_MODULE_NAME_KEY);
+    std::string abilityName = want.GetElement().GetAbilityName();
+    std::string formName = want.GetStringParam(Constants::PARAM_FORM_NAME_KEY);
+
+    std::vector<FormInfo> formInfos;
+    ErrCode errCode = FormInfoMgr::GetInstance().GetFormsInfoByModuleWithoutCheck(
+        bundleName, moduleName, formInfos, userId);
+    if (errCode != ERR_OK) {
+        HILOG_ERROR("Get forms info failed, bundle:%{public}s, module:%{public}s, userId:%{public}d",
+            bundleName.c_str(), moduleName.c_str(), userId);
+        return errCode;
+    }
+
+    // dimensionId existence already validated by HasParameter in ValidateParamsForCrossUser
+    int32_t dimensionId = want.GetIntParam(Constants::PARAM_FORM_DIMENSION_KEY, 0);
+    for (const auto &formInfo : formInfos) {
+        if ((formInfo.abilityName == abilityName) && (formInfo.name == formName) &&
+            (FormCommonAdapter::GetInstance().IsDimensionValid(formInfo, dimensionId))) {
+            return ERR_OK;
+        }
+    }
+
+    HILOG_ERROR("No matching form info found, ability:%{public}s, formName:%{public}s, dimensionId:%{public}d",
+        abilityName.c_str(), formName.c_str(), dimensionId);
+    return ERR_APPEXECFWK_FORM_INVALID_PARAM;
+}
+
 } // namespace AppExecFwk
 } // namespace OHOS