feat: support new icon and window cover judgement for security component

Signed-off-by: Haryslee <lihao189@huawei.com>

frameworks/BUILD.gn

@@ -50,6 +50,7 @@ ohos_source_set("security_component_framework_src_set") {
   public_configs = [ ":security_component_framework_src_set_config" ]
 
   external_deps = [
+    "access_token:libtokenid_sdk",
     "c_utils:utils",
     "hilog:libhilog",
     "ipc:ipc_core",

frameworks/security_component/src/save_button.cpp

@@ -16,6 +16,8 @@
 
 #include <tuple>
 #include "sec_comp_log.h"
+#include "tokenid_kit.h"
+#include "ipc_skeleton.h"
 
 namespace OHOS {
 namespace Security {
@@ -31,9 +33,20 @@ bool SaveButton::IsTextIconTypeValid()
         return false;
     }
 
+    if ((static_cast<SaveIcon>(icon_) == SaveIcon::PICTURE_ICON) && !IsSystemAppCalling()) {
+        SC_LOG_ERROR(LABEL, "Picture icon only for system application.");
+        return false;
+    }
+
     return true;
 }
 
+bool SaveButton::IsSystemAppCalling() const
+{
+    uint64_t fullTokenId = IPCSkeleton::GetCallingFullTokenID();
+    return AccessToken::TokenIdKit::IsSystemAppByFullTokenID(fullTokenId);
+}
+
 bool SaveButton::IsCorrespondenceType()
 {
     return (type_ == SAVE_COMPONENT);

interfaces/inner_api/security_component/include/save_button.h

@@ -39,6 +39,7 @@ enum class SaveDesc : int32_t {
 enum class SaveIcon : int32_t {
     FILLED_ICON = 0,
     LINE_ICON = 1,
+    PICTURE_ICON = 2,
     MAX_ICON_TYPE
 };
 
@@ -49,6 +50,7 @@ public:
     virtual bool CompareComponentBasicInfo(SecCompBase *other, bool isRectCheck) const override;
 private:
     bool ParseStyle(const nlohmann::json& json, const std::string& tag);
+    bool IsSystemAppCalling() const;
 };
 }  // namespace SecurityComponent
 }  // namespace Security

interfaces/inner_api/security_component/test/unittest/src/sec_comp_register_callback_test.cpp

@@ -254,7 +254,7 @@ HWTEST_F(SecCompRegisterCallbackTest, RegisterSecurityComponent005, TestSize.Lev
     ASSERT_NE(callback, nullptr);
     auto token = callback->AsObject();
     OnFirstUseDialogCloseFunc func = [] (int32_t) {};
-    EXPECT_EQ(SC_SERVICE_ERROR_WAIT_FOR_DIALOG_CLOSE,
+    EXPECT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID,
         ReportSecurityComponentClickEvent(scId, saveInfo, clickInfo, token, std::move(func)));
     EXPECT_EQ(SC_OK, SecCompKit::UnregisterSecurityComponent(scId));
     system("param set sec.comp.enhance 0");
@@ -306,7 +306,7 @@ HWTEST_F(SecCompRegisterCallbackTest, ReportSecurityComponentClickEvent001, Test
     ASSERT_NE(callback, nullptr);
     auto token = callback->AsObject();
     OnFirstUseDialogCloseFunc func = [] (int32_t) {};
-    ASSERT_EQ(SC_SERVICE_ERROR_WAIT_FOR_DIALOG_CLOSE,
+    ASSERT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID,
         ReportSecurityComponentClickEvent(scId, saveInfo, clickInfo, token, std::move(func)));
     EXPECT_EQ(SC_OK, SecCompKit::UnregisterSecurityComponent(scId));
     system("param set sec.comp.enhance 0");
@@ -384,7 +384,7 @@ HWTEST_F(SecCompRegisterCallbackTest, ReportSecurityComponentClickEvent003, Test
     ASSERT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID,
         ReportSecurityComponentClickEvent(scId, saveInfo, clickInfo, token, std::move(func)));
 #else
-    ASSERT_EQ(SC_SERVICE_ERROR_WAIT_FOR_DIALOG_CLOSE,
+    ASSERT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID,
         ReportSecurityComponentClickEvent(scId, saveInfo, clickInfo, token, std::move(func)));
 #endif
     EXPECT_EQ(SC_OK, SecCompKit::UnregisterSecurityComponent(scId));
@@ -455,7 +455,7 @@ HWTEST_F(SecCompRegisterCallbackTest, ReportClickWithoutHmac001, TestSize.Level1
     ASSERT_NE(callback, nullptr);
     auto token = callback->AsObject();
     OnFirstUseDialogCloseFunc func = [] (int32_t) {};
-    EXPECT_EQ(SC_SERVICE_ERROR_WAIT_FOR_DIALOG_CLOSE,
+    EXPECT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID,
         ReportSecurityComponentClickEvent(scId, locationInfo, clickInfo, token, std::move(func)));
     EXPECT_EQ(SC_OK, SecCompKit::UnregisterSecurityComponent(scId));
     system("param set sec.comp.enhance 0");
@@ -492,7 +492,7 @@ HWTEST_F(SecCompRegisterCallbackTest, VerifySavePermission001, TestSize.Level1)
     ASSERT_NE(callback, nullptr);
     auto token = callback->AsObject();
     OnFirstUseDialogCloseFunc func = [] (int32_t) {};
-    ASSERT_EQ(SC_SERVICE_ERROR_WAIT_FOR_DIALOG_CLOSE,
+    ASSERT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID,
         ReportSecurityComponentClickEvent(scId, saveInfo, clickInfo, token, std::move(func)));
     setuid(100);
     ASSERT_FALSE(SecCompKit::VerifySavePermission(TestCommon::HAP_TOKEN_ID));
@@ -532,7 +532,7 @@ HWTEST_F(SecCompRegisterCallbackTest, VerifySavePermission002, TestSize.Level1)
     ASSERT_NE(callback, nullptr);
     auto token = callback->AsObject();
     OnFirstUseDialogCloseFunc func = [] (int32_t) {};
-    ASSERT_EQ(SC_SERVICE_ERROR_WAIT_FOR_DIALOG_CLOSE,
+    ASSERT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID,
         ReportSecurityComponentClickEvent(scId, saveInfo, clickInfo, token, std::move(func)));
     EXPECT_EQ(SC_OK, SecCompKit::UnregisterSecurityComponent(scId));
     system("param set sec.comp.enhance 0");
@@ -567,7 +567,7 @@ HWTEST_F(SecCompRegisterCallbackTest, UnregisterSecurityComponent001, TestSize.L
     ASSERT_NE(callback, nullptr);
     auto token = callback->AsObject();
     OnFirstUseDialogCloseFunc func = [] (int32_t) {};
-    EXPECT_EQ(SC_SERVICE_ERROR_WAIT_FOR_DIALOG_CLOSE,
+    EXPECT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID,
         ReportSecurityComponentClickEvent(scId, saveInfo, clickInfo, token, std::move(func)));
     EXPECT_EQ(SC_OK, SecCompKit::UnregisterSecurityComponent(scId));
     system("param set sec.comp.enhance 0");

services/security_component_service/sa/sa_main/sec_comp_entity.cpp

@@ -80,6 +80,12 @@ int32_t SecCompEntity::CheckKeyEvent(const SecCompClickEvent& clickInfo) const
 
 int32_t SecCompEntity::CheckClickInfo(const SecCompClickEvent& clickInfo) const
 {
+    if (!WindowInfoHelper::CheckOtherWindowCoverComp(componentInfo_->windowId_,
+        componentInfo_->rect_)) {
+        SC_LOG_ERROR(LABEL, "Component may be covered by other window");
+        return SC_SERVICE_ERROR_CLICK_EVENT_INVALID;
+    }
+
     int32_t res = SC_SERVICE_ERROR_CLICK_EVENT_INVALID;
     if (clickInfo.type == ClickEventType::POINT_EVENT_TYPE) {
         res = CheckPointEvent(clickInfo);

services/security_component_service/sa/sa_main/window_info_helper.cpp

@@ -66,8 +66,8 @@ bool WindowInfoHelper::CheckOtherWindowCoverComp(int32_t compWinId, const SecCom
         SC_LOG_INFO(LABEL, "UI extension can not check");
         return true;
     }
-    std::vector<sptr<Rosen::AccessibilityWindowInfo>> infos;
-    if (Rosen::WindowManager::GetInstance().GetAccessibilityWindowInfo(infos) != Rosen::WMError::WM_OK) {
+    std::vector<sptr<Rosen::UnreliableWindowInfo>> infos;
+    if (Rosen::WindowManager::GetInstance().GetUnreliableWindowInfo(compWinId, infos) != Rosen::WMError::WM_OK) {
         SC_LOG_ERROR(LABEL, "Get AccessibilityWindowInfo failed");
         return false;
     }
@@ -79,16 +79,16 @@ bool WindowInfoHelper::CheckOtherWindowCoverComp(int32_t compWinId, const SecCom
             continue;
         }
 
-        if (info->wid_ == compWinId) {
-            compLayer = static_cast<int32_t>(info->layer_);
+        if (info->windowId_ == compWinId) {
+            compLayer = static_cast<int32_t>(info->zOrder_);
             continue;
         }
-        if (info->scaleVal_ != 0.0) {
-            info->windowRect_.width_ *= info->scaleVal_;
-            info->windowRect_.height_ *= info->scaleVal_;
+        if (info->floatingScale_ != 0.0) {
+            info->windowRect_.width_ *= info->floatingScale_;
+            info->windowRect_.height_ *= info->floatingScale_;
         }
         if (IsRectInWindRect(info->windowRect_, secRect)) {
-            layerList.emplace_back(info->layer_);
+            layerList.emplace_back(info->zOrder_);
         }
     }
 

services/security_component_service/sa/test/mock/include/window_manager.h

@@ -57,6 +57,22 @@ public:
     float scaleVal_;
 };
 
+class UnreliableWindowInfo : public Parcelable {
+public:
+    UnreliableWindowInfo() = default;
+    ~UnreliableWindowInfo() = default;
+    virtual bool Marshalling(Parcel& parcel) const override
+    {
+        return true;
+    };
+    int32_t windowId_ { 0 };
+    Rect windowRect_;
+    uint32_t zOrder_ { 0 };
+    float floatingScale_ { 1.0f };
+    float scaleX_ { 1.0f };
+    float scaleY_ { 1.0f };
+};
+
 class WindowManager {
 public:
     static WindowManager& GetInstance()
@@ -70,6 +86,10 @@ public:
         list = list_;
         return result_;
     };
+    WMError GetUnreliableWindowInfo(int32_t windowId, std::vector<sptr<UnreliableWindowInfo>>& infos) const
+    {
+        return result_;
+    }
 
     WindowManager() {};
 

services/security_component_service/sa/test/unittest/src/sec_comp_entity_test.cpp

@@ -137,7 +137,7 @@ HWTEST_F(SecCompEntityTest, CheckClickInfo001, TestSize.Level1)
     touch.extraInfo.data = buffer;
     touch.point.timestamp = static_cast<uint64_t>(
         std::chrono::high_resolution_clock::now().time_since_epoch().count()) / ServiceTestCommon::TIME_CONVERSION_UNIT;
-    ASSERT_EQ(entity_->CheckClickInfo(touch), SC_OK);
+    ASSERT_EQ(entity_->CheckClickInfo(touch), SC_SERVICE_ERROR_CLICK_EVENT_INVALID);
 }
 
 /**

services/security_component_service/sa/test/unittest/src/sec_comp_service_mock_test.cpp

@@ -114,7 +114,8 @@ HWTEST_F(SecCompServiceMockTest, RegisterSecurityComponent001, TestSize.Level1)
         },
     };
 
-    EXPECT_EQ(SC_OK, secCompService_->ReportSecurityComponentClickEvent(scId, saveInfo, touch, nullptr, nullptr));
+    EXPECT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID, secCompService_->ReportSecurityComponentClickEvent(scId,
+            saveInfo, touch, nullptr, nullptr));
     EXPECT_EQ(SC_OK, secCompService_->UnregisterSecurityComponent(scId));
     SecCompPermManager::GetInstance().applySaveCountMap_.clear();
 }
@@ -189,7 +190,7 @@ HWTEST_F(SecCompServiceMockTest, RegisterSecurityComponent003, TestSize.Level1)
             .dataSize = 1
         },
     };
-    EXPECT_EQ(SC_SERVICE_ERROR_PERMISSION_OPER_FAIL,
+    EXPECT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID,
         secCompService_->ReportSecurityComponentClickEvent(scId, saveInfo, touch, nullptr, nullptr));
     EXPECT_EQ(SC_OK, secCompService_->UnregisterSecurityComponent(scId));
     SecCompPermManager::GetInstance().applySaveCountMap_.clear();
@@ -231,24 +232,27 @@ HWTEST_F(SecCompServiceMockTest, ReportSecurityComponentClickEvent001, TestSize.
         },
     };
 
-    ASSERT_EQ(SC_OK, secCompService_->ReportSecurityComponentClickEvent(scId, saveInfo, clickInfo, nullptr, nullptr));
+    ASSERT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID, secCompService_->ReportSecurityComponentClickEvent(scId, saveInfo,
+        clickInfo, nullptr, nullptr));
 
     // test 10s valid
-    ASSERT_TRUE(secCompService_->VerifySavePermission(ServiceTestCommon::HAP_TOKEN_ID));
-    ASSERT_TRUE(secCompService_->VerifySavePermission(ServiceTestCommon::HAP_TOKEN_ID));
+    ASSERT_FALSE(secCompService_->VerifySavePermission(ServiceTestCommon::HAP_TOKEN_ID));
+    ASSERT_FALSE(secCompService_->VerifySavePermission(ServiceTestCommon::HAP_TOKEN_ID));
     sleep(11);
     ASSERT_FALSE(secCompService_->VerifySavePermission(ServiceTestCommon::HAP_TOKEN_ID));
 
     // test 10s multiple clicks
     clickInfo.point.timestamp = static_cast<uint64_t>(
         std::chrono::high_resolution_clock::now().time_since_epoch().count()) / ServiceTestCommon::TIME_CONVERSION_UNIT;
-    ASSERT_EQ(SC_OK, secCompService_->ReportSecurityComponentClickEvent(scId, saveInfo, clickInfo, nullptr, nullptr));
+    ASSERT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID, secCompService_->ReportSecurityComponentClickEvent(scId,
+        saveInfo, clickInfo, nullptr, nullptr));
     sleep(3);
     clickInfo.point.timestamp = static_cast<uint64_t>(
         std::chrono::high_resolution_clock::now().time_since_epoch().count()) / ServiceTestCommon::TIME_CONVERSION_UNIT;
-    ASSERT_EQ(SC_OK, secCompService_->ReportSecurityComponentClickEvent(scId, saveInfo, clickInfo, nullptr, nullptr));
+    ASSERT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID, secCompService_->ReportSecurityComponentClickEvent(scId,
+        saveInfo, clickInfo, nullptr, nullptr));
     sleep(8);
-    ASSERT_TRUE(secCompService_->VerifySavePermission(ServiceTestCommon::HAP_TOKEN_ID));
+    ASSERT_FALSE(secCompService_->VerifySavePermission(ServiceTestCommon::HAP_TOKEN_ID));
     sleep(2);
     EXPECT_EQ(SC_OK, secCompService_->UnregisterSecurityComponent(scId));
 }
@@ -290,21 +294,21 @@ HWTEST_F(SecCompServiceMockTest, ReportSecurityComponentClickEvent002, TestSize.
         },
     };
 
-    ASSERT_EQ(SC_OK,
+    ASSERT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID,
         secCompService_->ReportSecurityComponentClickEvent(scId, locationInfo, clickInfo1, nullptr, nullptr));
 
     // test 10s valid
-    ASSERT_EQ(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID, "ohos.permission.LOCATION"), 0);
-    ASSERT_EQ(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID,
+    ASSERT_NE(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID, "ohos.permission.LOCATION"), 0);
+    ASSERT_NE(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID,
         "ohos.permission.APPROXIMATELY_LOCATION"), 0);
     sleep(11);
-    ASSERT_EQ(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID, "ohos.permission.LOCATION"), 0);
-    ASSERT_EQ(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID,
+    ASSERT_NE(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID, "ohos.permission.LOCATION"), 0);
+    ASSERT_NE(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID,
         "ohos.permission.APPROXIMATELY_LOCATION"), 0);
 
     SecCompManager::GetInstance().NotifyProcessBackground(getpid());
-    ASSERT_EQ(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID, "ohos.permission.LOCATION"), 0);
-    ASSERT_EQ(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID,
+    ASSERT_NE(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID, "ohos.permission.LOCATION"), 0);
+    ASSERT_NE(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID,
         "ohos.permission.APPROXIMATELY_LOCATION"), 0);
     sleep(11);
     ASSERT_NE(AccessTokenKit::VerifyAccessToken(ServiceTestCommon::HAP_TOKEN_ID, "ohos.permission.LOCATION"), 0);

services/security_component_service/sa/test/unittest/src/sec_comp_service_test.cpp

@@ -273,7 +273,7 @@ HWTEST_F(SecCompServiceTest, ReportSecurityComponentClickEvent001, TestSize.Leve
         .extraInfo.data = data,
         .extraInfo.dataSize = 16,
     };
-    EXPECT_EQ(SC_OK,
+    EXPECT_EQ(SC_SERVICE_ERROR_CLICK_EVENT_INVALID,
         secCompService_->ReportSecurityComponentClickEvent(scId, locationInfo, touch, nullptr, nullptr));
     EXPECT_EQ(SC_OK, secCompService_->UnregisterSecurityComponent(scId));
     setuid(uid);

services/security_component_service/sa/test/unittest/src/window_info_helper_test.cpp

@@ -149,5 +149,5 @@ HWTEST_F(WindowInfoHelperTest, CheckOtherWindowCoverComp003, TestSize.Level1)
         ServiceTestCommon::TEST_COORDINATE, ServiceTestCommon::TEST_COORDINATE,
         ServiceTestCommon::TEST_COORDINATE, ServiceTestCommon::TEST_COORDINATE
     };
-    ASSERT_TRUE(WindowInfoHelper::CheckOtherWindowCoverComp(0, compRect));
+    ASSERT_FALSE(WindowInfoHelper::CheckOtherWindowCoverComp(0, compRect));
 }