From eee2d66da682cb88decebb0207c80f89f089eec4 Mon Sep 17 00:00:00 2001 From: Sean_Su Date: Tue, 21 Jul 2026 10:04:19 +0800 Subject: [PATCH] CO-authored-by: OpenCode+GLM5 Signed-off-by: Sean_Su --- .../accessibility_ipc_interface_code.h | 3 + .../include/accessible_ability_channel_stub.h | 6 ++ .../src/accessible_ability_channel_proxy.cpp | 61 +++++++++------- .../src/accessible_ability_channel_stub.cpp | 62 ++++++++++++++-- ...leabilitychannelstubfindfocused_fuzzer.cpp | 70 +++++++++++++++++++ ...essibleabilitychannelstubsearch_fuzzer.cpp | 39 +++++++++++ .../aams/src/accessible_ability_channel.cpp | 12 ---- 7 files changed, 210 insertions(+), 43 deletions(-) diff --git a/common/interface/include/accessibility_ipc_interface_code.h b/common/interface/include/accessibility_ipc_interface_code.h index 634f58cfb..497b0c6d1 100644 --- a/common/interface/include/accessibility_ipc_interface_code.h +++ b/common/interface/include/accessibility_ipc_interface_code.h @@ -61,8 +61,11 @@ namespace Accessibility { SEARCH_ELEMENTINFO_BY_ACCESSIBILITY_ID = 400, SEARCH_ELEMENTINFOS_BY_TEXT, + SEARCH_ELEMENTINFOS_BY_TEXT_WITH_PERMISSION, FIND_FOCUSED_ELEMENTINFO, + FIND_FOCUSED_ELEMENTINFO_WITH_PERMISSION, FOCUS_MOVE_SEARCH, + FOCUS_MOVE_SEARCH_WITH_PERMISSION, PERFORM_ACTION, PERFORM_ACTION_WITH_PERMISSION, SET_CURTAIN_SCREEN, diff --git a/common/interface/include/accessible_ability_channel_stub.h b/common/interface/include/accessible_ability_channel_stub.h index 781a25d22..1403a6d9e 100644 --- a/common/interface/include/accessible_ability_channel_stub.h +++ b/common/interface/include/accessible_ability_channel_stub.h @@ -68,6 +68,8 @@ private: */ ErrCode HandleSearchElementInfosByText(MessageParcel &data, MessageParcel &reply); + ErrCode HandleSearchElementInfosByTextWithPermission(MessageParcel &data, MessageParcel &reply); + /** * @brief Handle the IPC request for the function:HandleFindFocusedElementInfo. * @param data The data of process communication @@ -76,6 +78,8 @@ private: */ ErrCode HandleFindFocusedElementInfo(MessageParcel &data, MessageParcel &reply); + ErrCode HandleFindFocusedElementInfoWithPermission(MessageParcel &data, MessageParcel &reply); + /** * @brief Handle the IPC request for the function:HandleFocusMoveSearch. * @param data The data of process communication @@ -84,6 +88,8 @@ private: */ ErrCode HandleFocusMoveSearch(MessageParcel &data, MessageParcel &reply); + ErrCode HandleFocusMoveSearchWithPermission(MessageParcel &data, MessageParcel &reply); + /** * @brief Handle the IPC request for the function:HandleExecuteAction. * @param data The data of process communication diff --git a/common/interface/src/accessible_ability_channel_proxy.cpp b/common/interface/src/accessible_ability_channel_proxy.cpp index 01424e8cd..868e97dd9 100644 --- a/common/interface/src/accessible_ability_channel_proxy.cpp +++ b/common/interface/src/accessible_ability_channel_proxy.cpp @@ -231,15 +231,18 @@ RetError AccessibleAbilityChannelProxy::SearchElementInfosByText(const int32_t a HILOG_ERROR("callback write error"); return RET_ERR_IPC_FAILED; } - if (!data.WriteBool(systemApi)) { - HILOG_ERROR("systemApi write error: %{public}d, ", systemApi); - return RET_ERR_IPC_FAILED; - } - - if (!SendTransactCmd(AccessibilityInterfaceCode::SEARCH_ELEMENTINFOS_BY_TEXT, - data, reply, option)) { - HILOG_ERROR("fail to find elementInfo by text"); - return RET_ERR_IPC_FAILED; + if (systemApi) { + if (!SendTransactCmd(AccessibilityInterfaceCode::SEARCH_ELEMENTINFOS_BY_TEXT_WITH_PERMISSION, + data, reply, option)) { + HILOG_ERROR("fail to find elementInfo by text with permission"); + return RET_ERR_IPC_FAILED; + } + } else { + if (!SendTransactCmd(AccessibilityInterfaceCode::SEARCH_ELEMENTINFOS_BY_TEXT, + data, reply, option)) { + HILOG_ERROR("fail to find elementInfo by text"); + return RET_ERR_IPC_FAILED; + } } return static_cast(reply.ReadInt32()); } @@ -281,14 +284,18 @@ RetError AccessibleAbilityChannelProxy::FindFocusedElementInfo(const int32_t acc HILOG_ERROR("callback write error"); return RET_ERR_IPC_FAILED; } - if (!data.WriteBool(systemApi)) { - HILOG_ERROR("systemApi write error: %{public}d, ", systemApi); - return RET_ERR_IPC_FAILED; - } - - if (!SendTransactCmd(AccessibilityInterfaceCode::FIND_FOCUSED_ELEMENTINFO, data, reply, option)) { - HILOG_ERROR("fail to gain focus"); - return RET_ERR_IPC_FAILED; + if (systemApi) { + if (!SendTransactCmd(AccessibilityInterfaceCode::FIND_FOCUSED_ELEMENTINFO_WITH_PERMISSION, + data, reply, option)) { + HILOG_ERROR("fail to gain focus with permission"); + return RET_ERR_IPC_FAILED; + } + } else { + if (!SendTransactCmd(AccessibilityInterfaceCode::FIND_FOCUSED_ELEMENTINFO, + data, reply, option)) { + HILOG_ERROR("fail to gain focus"); + return RET_ERR_IPC_FAILED; + } } return static_cast(reply.ReadInt32()); } @@ -330,14 +337,18 @@ RetError AccessibleAbilityChannelProxy::FocusMoveSearch(const int32_t accessibil HILOG_ERROR("callback write error"); return RET_ERR_IPC_FAILED; } - if (!data.WriteBool(systemApi)) { - HILOG_ERROR("systemApi write error: %{public}d, ", systemApi); - return RET_ERR_IPC_FAILED; - } - - if (!SendTransactCmd(AccessibilityInterfaceCode::FOCUS_MOVE_SEARCH, data, reply, option)) { - HILOG_ERROR("fail to search focus"); - return RET_ERR_IPC_FAILED; + if (systemApi) { + if (!SendTransactCmd(AccessibilityInterfaceCode::FOCUS_MOVE_SEARCH_WITH_PERMISSION, + data, reply, option)) { + HILOG_ERROR("fail to search focus with permission"); + return RET_ERR_IPC_FAILED; + } + } else { + if (!SendTransactCmd(AccessibilityInterfaceCode::FOCUS_MOVE_SEARCH, + data, reply, option)) { + HILOG_ERROR("fail to search focus"); + return RET_ERR_IPC_FAILED; + } } return static_cast(reply.ReadInt32()); } diff --git a/common/interface/src/accessible_ability_channel_stub.cpp b/common/interface/src/accessible_ability_channel_stub.cpp index 5b5dd1f13..eedb9bb0e 100644 --- a/common/interface/src/accessible_ability_channel_stub.cpp +++ b/common/interface/src/accessible_ability_channel_stub.cpp @@ -42,8 +42,13 @@ SWITCH_CASE( \ AccessibilityInterfaceCode::SEARCH_ELEMENTINFO_BY_ACCESSIBILITY_ID, HandleSearchElementInfoByAccessibilityId) \ SWITCH_CASE(AccessibilityInterfaceCode::SEARCH_ELEMENTINFOS_BY_TEXT, HandleSearchElementInfosByText) \ + SWITCH_CASE(AccessibilityInterfaceCode::SEARCH_ELEMENTINFOS_BY_TEXT_WITH_PERMISSION, \ + HandleSearchElementInfosByTextWithPermission) \ SWITCH_CASE(AccessibilityInterfaceCode::FIND_FOCUSED_ELEMENTINFO, HandleFindFocusedElementInfo) \ + SWITCH_CASE(AccessibilityInterfaceCode::FIND_FOCUSED_ELEMENTINFO_WITH_PERMISSION, \ + HandleFindFocusedElementInfoWithPermission) \ SWITCH_CASE(AccessibilityInterfaceCode::FOCUS_MOVE_SEARCH, HandleFocusMoveSearch) \ + SWITCH_CASE(AccessibilityInterfaceCode::FOCUS_MOVE_SEARCH_WITH_PERMISSION, HandleFocusMoveSearchWithPermission) \ SWITCH_CASE(AccessibilityInterfaceCode::PERFORM_ACTION, HandleExecuteAction) \ SWITCH_CASE(AccessibilityInterfaceCode::SET_CURTAIN_SCREEN, HandleEnableScreenCurtain) \ SWITCH_CASE(AccessibilityInterfaceCode::HOLD_RUNNING_LOCK, HandleHoldRunningLock) \ @@ -201,6 +206,11 @@ ErrCode AccessibleAbilityChannelStub::HandleSearchElementInfosByText(MessageParc MessageParcel &reply) { HILOG_DEBUG(); + if (!Permission::IsSystemApp()) { + HILOG_WARN("Not system app"); + reply.WriteInt32(RET_ERR_NOT_SYSTEM_APP); + return RET_ERR_NOT_SYSTEM_APP; + } int32_t accessibilityWindowId = data.ReadInt32(); int64_t elementId = data.ReadInt64(); @@ -218,8 +228,7 @@ ErrCode AccessibleAbilityChannelStub::HandleSearchElementInfosByText(MessageParc HILOG_ERROR("callback is nullptr."); return ERR_INVALID_VALUE; } - bool systemApi = data.ReadBool(); - RetError result = SearchElementInfosByText(accessibilityWindowId, elementId, text, requestId, callback, systemApi); + RetError result = SearchElementInfosByText(accessibilityWindowId, elementId, text, requestId, callback, false); HILOG_DEBUG("SearchElementInfosByText ret = %{public}d", result); reply.WriteInt32(result); @@ -229,6 +238,11 @@ ErrCode AccessibleAbilityChannelStub::HandleSearchElementInfosByText(MessageParc ErrCode AccessibleAbilityChannelStub::HandleFindFocusedElementInfo(MessageParcel &data, MessageParcel &reply) { HILOG_DEBUG(); + if (!Permission::IsSystemApp()) { + HILOG_WARN("Not system app"); + reply.WriteInt32(RET_ERR_NOT_SYSTEM_APP); + return RET_ERR_NOT_SYSTEM_APP; + } int32_t accessibilityWindowId = data.ReadInt32(); int64_t elementId = data.ReadInt64(); @@ -246,10 +260,9 @@ ErrCode AccessibleAbilityChannelStub::HandleFindFocusedElementInfo(MessageParcel HILOG_ERROR("callback is nullptr."); return ERR_INVALID_VALUE; } - bool systemApi = data.ReadBool(); RetError result = - FindFocusedElementInfo(accessibilityWindowId, elementId, focusType, requestId, callback, systemApi); + FindFocusedElementInfo(accessibilityWindowId, elementId, focusType, requestId, callback, false); HILOG_DEBUG("FindFocusedElementInfo ret = %{public}d", result); reply.WriteInt32(result); return NO_ERROR; @@ -258,6 +271,11 @@ ErrCode AccessibleAbilityChannelStub::HandleFindFocusedElementInfo(MessageParcel ErrCode AccessibleAbilityChannelStub::HandleFocusMoveSearch(MessageParcel &data, MessageParcel &reply) { HILOG_DEBUG(); + if (!Permission::IsSystemApp()) { + HILOG_WARN("Not system app"); + reply.WriteInt32(RET_ERR_NOT_SYSTEM_APP); + return RET_ERR_NOT_SYSTEM_APP; + } int32_t accessibilityWindowId = data.ReadInt32(); int64_t elementId = data.ReadInt64(); @@ -275,15 +293,47 @@ ErrCode AccessibleAbilityChannelStub::HandleFocusMoveSearch(MessageParcel &data, HILOG_ERROR("callback is nullptr."); return ERR_INVALID_VALUE; } - bool systemApi = data.ReadBool(); - RetError result = FocusMoveSearch(accessibilityWindowId, elementId, direction, requestId, callback, systemApi); + RetError result = FocusMoveSearch(accessibilityWindowId, elementId, direction, requestId, callback, false); HILOG_DEBUG("FocusMoveSearch ret = %{public}d", result); reply.WriteInt32(result); return NO_ERROR; } +ErrCode AccessibleAbilityChannelStub::HandleSearchElementInfosByTextWithPermission(MessageParcel &data, + MessageParcel &reply) +{ + HILOG_DEBUG(); + if (!Permission::CheckPermission(OHOS_PERMISSION_ACCESSIBILITY_EXTENSION_ABILITY)) { + reply.WriteInt32(RET_ERR_NO_PERMISSION); + return RET_ERR_NO_PERMISSION; + } + return HandleSearchElementInfosByText(data, reply); +} + +ErrCode AccessibleAbilityChannelStub::HandleFindFocusedElementInfoWithPermission(MessageParcel &data, + MessageParcel &reply) +{ + HILOG_DEBUG(); + if (!Permission::CheckPermission(OHOS_PERMISSION_ACCESSIBILITY_EXTENSION_ABILITY)) { + reply.WriteInt32(RET_ERR_NO_PERMISSION); + return RET_ERR_NO_PERMISSION; + } + return HandleFindFocusedElementInfo(data, reply); +} + +ErrCode AccessibleAbilityChannelStub::HandleFocusMoveSearchWithPermission(MessageParcel &data, + MessageParcel &reply) +{ + HILOG_DEBUG(); + if (!Permission::CheckPermission(OHOS_PERMISSION_ACCESSIBILITY_EXTENSION_ABILITY)) { + reply.WriteInt32(RET_ERR_NO_PERMISSION); + return RET_ERR_NO_PERMISSION; + } + return HandleFocusMoveSearch(data, reply); +} + ErrCode AccessibleAbilityChannelStub::HandleExecuteAction(MessageParcel &data, MessageParcel &reply) { HILOG_DEBUG(); diff --git a/common/interface/test/fuzztest/accessibleabilitychannelstub/accessibleabilitychannelstubfindfocused_fuzzer/accessibleabilitychannelstubfindfocused_fuzzer.cpp b/common/interface/test/fuzztest/accessibleabilitychannelstub/accessibleabilitychannelstubfindfocused_fuzzer/accessibleabilitychannelstubfindfocused_fuzzer.cpp index 8d08b8077..deebcfcf2 100644 --- a/common/interface/test/fuzztest/accessibleabilitychannelstub/accessibleabilitychannelstubfindfocused_fuzzer/accessibleabilitychannelstubfindfocused_fuzzer.cpp +++ b/common/interface/test/fuzztest/accessibleabilitychannelstub/accessibleabilitychannelstubfindfocused_fuzzer/accessibleabilitychannelstubfindfocused_fuzzer.cpp @@ -57,6 +57,40 @@ bool FuzzHandleFindFocusedElementInfo(const uint8_t *data, size_t size) return true; } +bool FuzzHandleFindFocusedElementInfoWithPermission(const uint8_t *data, size_t size) +{ + if (data == nullptr || size < DATA_MIN_SIZE) { + return false; + } + + size_t position = 0; + int32_t accessibilityWindowId = 0; + int64_t elementId = 0; + int32_t focusType = 0; + int32_t requestId = 0; + MessageParcel mdata; + MessageParcel reply; + MessageOption option(MessageOption::TF_SYNC); + + position += GetObject(accessibilityWindowId, &data[position], size - position); + position += GetObject(elementId, &data[position], size - position); + position += GetObject(focusType, &data[position], size - position); + GetObject(requestId, &data[position], size - position); + std::shared_ptr chanImp = std::make_shared(); + if (chanImp == nullptr) { + return false; + } + mdata.WriteInterfaceToken(AccessibleAbilityChannelStub::GetDescriptor()); + mdata.WriteInt32(accessibilityWindowId); + mdata.WriteInt64(elementId); + mdata.WriteInt32(focusType); + mdata.WriteInt32(requestId); + chanImp->OnRemoteRequest( + static_cast(AccessibilityInterfaceCode::FIND_FOCUSED_ELEMENTINFO_WITH_PERMISSION), + mdata, reply, option); + return true; +} + bool FuzzHandleFocusMoveSearch(const uint8_t *data, size_t size) { if (data == nullptr || size < DATA_MIN_SIZE) { @@ -90,10 +124,46 @@ bool FuzzHandleFocusMoveSearch(const uint8_t *data, size_t size) return true; } +bool FuzzHandleFocusMoveSearchWithPermission(const uint8_t *data, size_t size) +{ + if (data == nullptr || size < DATA_MIN_SIZE) { + return false; + } + + size_t position = 0; + int32_t accessibilityWindowId = 0; + int64_t elementId = 0; + int32_t direction = 0; + int32_t requestId = 0; + MessageParcel mdata; + MessageParcel reply; + MessageOption option(MessageOption::TF_SYNC); + + position += GetObject(accessibilityWindowId, &data[position], size - position); + position += GetObject(elementId, &data[position], size - position); + position += GetObject(direction, &data[position], size - position); + GetObject(requestId, &data[position], size - position); + std::shared_ptr chanImp = std::make_shared(); + if (chanImp == nullptr) { + return false; + } + mdata.WriteInterfaceToken(AccessibleAbilityChannelStub::GetDescriptor()); + mdata.WriteInt32(accessibilityWindowId); + mdata.WriteInt64(elementId); + mdata.WriteInt32(direction); + mdata.WriteInt32(requestId); + chanImp->OnRemoteRequest( + static_cast(AccessibilityInterfaceCode::FOCUS_MOVE_SEARCH_WITH_PERMISSION), + mdata, reply, option); + return true; +} + bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size) { FuzzHandleFindFocusedElementInfo(data, size); + FuzzHandleFindFocusedElementInfoWithPermission(data, size); FuzzHandleFocusMoveSearch(data, size); + FuzzHandleFocusMoveSearchWithPermission(data, size); return true; } } // namespace Accessibility diff --git a/common/interface/test/fuzztest/accessibleabilitychannelstub/accessibleabilitychannelstubsearch_fuzzer/accessibleabilitychannelstubsearch_fuzzer.cpp b/common/interface/test/fuzztest/accessibleabilitychannelstub/accessibleabilitychannelstubsearch_fuzzer/accessibleabilitychannelstubsearch_fuzzer.cpp index 60072d851..a708e059f 100644 --- a/common/interface/test/fuzztest/accessibleabilitychannelstub/accessibleabilitychannelstubsearch_fuzzer/accessibleabilitychannelstubsearch_fuzzer.cpp +++ b/common/interface/test/fuzztest/accessibleabilitychannelstub/accessibleabilitychannelstubsearch_fuzzer/accessibleabilitychannelstubsearch_fuzzer.cpp @@ -90,6 +90,44 @@ bool FuzzHandleSearchElementInfosByText(const uint8_t *data, size_t size) return true; } +bool FuzzHandleSearchElementInfosByTextWithPermission(const uint8_t *data, size_t size) +{ + if (data == nullptr || size < DATA_MIN_SIZE) { + return false; + } + + size_t position = 0; + int32_t accessibilityWindowId = 0; + int64_t elementId = 0; + int32_t requestId = 0; + MessageParcel mdata; + MessageParcel reply; + MessageOption option(MessageOption::TF_SYNC); + + position += GetObject(accessibilityWindowId, &data[position], size - position); + position += GetObject(elementId, &data[position], size - position); + char name[LEN + 1]; + name[LEN] = END_CHAR; + for (size_t i = 0; i < LEN; i++) { + position += GetObject(name[i], data + position, size - position); + } + std::string text(name); + GetObject(requestId, &data[position], size - position); + std::shared_ptr chanImp = std::make_shared(); + if (chanImp == nullptr) { + return false; + } + mdata.WriteInterfaceToken(AccessibleAbilityChannelStub::GetDescriptor()); + mdata.WriteInt32(accessibilityWindowId); + mdata.WriteInt64(elementId); + mdata.WriteString(text); + mdata.WriteInt32(requestId); + chanImp->OnRemoteRequest( + static_cast(AccessibilityInterfaceCode::SEARCH_ELEMENTINFOS_BY_TEXT_WITH_PERMISSION), + mdata, reply, option); + return true; +} + bool FuzzHandleFindFocusedElementInfo(const uint8_t *data, size_t size) { if (data == nullptr || size < DATA_MIN_SIZE) { @@ -160,6 +198,7 @@ bool DoSomethingInterestingWithMyAPI(const uint8_t* data, size_t size) { FuzzHandleSearchElementInfoByAccessibilityId(data, size); FuzzHandleSearchElementInfosByText(data, size); + FuzzHandleSearchElementInfosByTextWithPermission(data, size); FuzzHandleFindFocusedElementInfo(data, size); FuzzHandleFocusMoveSearch(data, size); return true; diff --git a/services/aams/src/accessible_ability_channel.cpp b/services/aams/src/accessible_ability_channel.cpp index 5b1c31158..03a2b796e 100644 --- a/services/aams/src/accessible_ability_channel.cpp +++ b/services/aams/src/accessible_ability_channel.cpp @@ -206,10 +206,6 @@ RetError AccessibleAbilityChannel::SearchElementInfosByText(const int32_t access { HILOG_DEBUG("SearchElementInfosByText :channel SearchElementInfo elementId: %{public}" PRId64 " winId: %{public}d", elementId, accessibilityWindowId); - if (systemApi && !Singleton::GetInstance().CheckPermission( - OHOS_PERMISSION_ACCESSIBILITY_EXTENSION_ABILITY)) { - return RET_ERR_NO_PERMISSION; - } Singleton::GetInstance().PostDelayUnloadTask(); if (eventHandler_ == nullptr) { HILOG_ERROR("eventHandler_ is nullptr."); @@ -263,10 +259,6 @@ RetError AccessibleAbilityChannel::FindFocusedElementInfo(const int32_t accessib { HILOG_DEBUG("channel FindFocusedElementInfo elementId: %{public}" PRId64 " winId: %{public}d", elementId, accessibilityWindowId); - if (systemApi && !Singleton::GetInstance().CheckPermission( - OHOS_PERMISSION_ACCESSIBILITY_EXTENSION_ABILITY)) { - return RET_ERR_NO_PERMISSION; - } Singleton::GetInstance().PostDelayUnloadTask(); if (eventHandler_ == nullptr) { HILOG_ERROR("eventHandler_ is nullptr."); @@ -323,10 +315,6 @@ RetError AccessibleAbilityChannel::FocusMoveSearch(const int32_t accessibilityWi { HILOG_DEBUG("FocusMoveSearch :channel FocusMoveSearch elementId: %{public}" PRId64 " winId: %{public}d", elementId, accessibilityWindowId); - if (systemApi && !Singleton::GetInstance().CheckPermission( - OHOS_PERMISSION_ACCESSIBILITY_EXTENSION_ABILITY)) { - return RET_ERR_NO_PERMISSION; - } Singleton::GetInstance().PostDelayUnloadTask(); if (eventHandler_ == nullptr) { HILOG_ERROR("eventHandler_ is nullptr.");