Fix sender validation

Change-Id: I6fe2b5add1d61cef5c8f47b13a37f7c5ea43ea87
Signed-off-by: jusung son <jusung07.son@samsung.com>
Signed-off-by: pjh9216 <jh9216.park@samsung.com>
Signed-off-by: jusung son <jusung07.son@samsung.com>

diff --git a/modules/group/es_stub.cc b/modules/group/es_stub.cc
index c8e146bdf31ae0b644d930e7941c550c170e67fc..5d5cdddcbaaf3ee111a86c56cf81710c22682226 100644 (file)
--- a/modules/group/es_stub.cc
+++ b/modules/group/es_stub.cc
@@ -24,6 +24,8 @@
 #include <rpc-port-parcel-internal.h>
 #include <rpc-port-parcel.h>
 #include <rpc-port.h>
+#include <rpc-port-internal.h>
+
 #include <unistd.h>
 
 #include <map>
@@ -54,6 +56,9 @@
 
 namespace {
 
+constexpr const uid_t kRegularUidMin = 5000;
+constexpr const char kUserEventNamePrefix[] = "event.";
+
 rpc_port_parcel_h Clone(rpc_port_parcel_h parcel) {
   void* raw = nullptr;
   unsigned int size = 0;
@@ -86,6 +91,32 @@ bool IdleAddOnce(GMainContext* context, std::function<void()>* func) {
 }
 /* LCOV_EXCL_STOP */
 
+bool CheckUserEventSenderValid(std::string_view event_name,
+    std::string_view app_id) {
+  auto it = event_name.rfind('.');
+  if (it == std::string::npos) {
+    _E("invalid event name");
+    return false;
+  }
+
+  event_name = event_name.substr(0, it);
+  auto len = event_name.length();
+  if (len <= 1 || len > 128) {
+    _E("invalid length(%zu) of user-defined name", len);
+    return false;
+  }
+
+  std::string valid_name = kUserEventNamePrefix + std::string(app_id);
+  _D("valid_name(%s), event_name(%s) ", valid_name.c_str(),  event_name.data());
+
+  if (valid_name != event_name) {
+    _E("appid misamatch (%s) - (%s)", valid_name.c_str(), event_name.data());
+    return false;
+  }
+
+  return true;
+}
+
 std::shared_ptr<rpc_port::es_stub::LocalExecution> EventSystem_context_;
 
 }  // namespace
@@ -349,15 +380,17 @@ void EventSystem::ServiceBase::Dispatch(rpc_port_h port,
     case static_cast<int>(MethodId::SendUserEvent): {
       char* param1_raw = nullptr;
       rpc_port_parcel_read_string(parcel, &param1_raw);
-      std::string param1(param1_raw);
+      std::string event_name(param1_raw);
       free(param1_raw);
       bundle* param2_raw = nullptr;
       rpc_port_parcel_read_bundle(parcel, &param2_raw);
       Bundle param2(param2_raw, false, true);
       bool param3;
       rpc_port_parcel_read_bool(parcel, &param3);
-      auto retVal =
-          service->SendUserEvent(std::move(param1), std::move(param2), param3);
+      bool retVal = false;
+
+      if (CheckUserEventSenderValid(event_name, sender_))
+        retVal = service->SendUserEvent(std::move(event_name), std::move(param2), param3);
       rpc_port_parcel_write_int32(result, static_cast<int>(MethodId::__Result));
       rpc_port_parcel_write_bool(result, retVal);
       if (GetContext() != nullptr) {
@@ -376,8 +409,18 @@ void EventSystem::ServiceBase::Dispatch(rpc_port_h port,
       bundle* param2_raw = nullptr;
       rpc_port_parcel_read_bundle(parcel, &param2_raw);
       Bundle param2(param2_raw, false, true);
-      auto retVal =
-          service->SendSystemEvent(std::move(param1), std::move(param2));
+
+      bool retVal = false;
+      uid_t uid;
+      int ret = rpc_port_get_peer_info(port, nullptr, &uid);
+      if (ret != 0) {
+        _E("Failed to rpc_port_get_peer_info. (%d)", ret);
+      } else if (uid >= kRegularUidMin) {
+        _E("Failed to send system event. uid(%u)", uid);
+      } else {
+        retVal = service->SendSystemEvent(std::move(param1), std::move(param2));
+      }
+
       rpc_port_parcel_write_int32(result, static_cast<int>(MethodId::__Result));
       rpc_port_parcel_write_bool(result, retVal);
       if (GetContext() != nullptr) {

diff --git a/tests/integ_tests/eventsystem_test.cc b/tests/integ_tests/eventsystem_test.cc
index 0aa5f542d07fb9603110148dd83d7ddba80352f3..508a76dc02413f7312566c986d28b412d63bff9d 100644 (file)
--- a/tests/integ_tests/eventsystem_test.cc
+++ b/tests/integ_tests/eventsystem_test.cc
@@ -109,12 +109,6 @@ TEST_F(EventSystemTest, eventsystem_unregister_event) {
   EXPECT_EQ(ret, ES_R_OK);
 }
 
-TEST_F(EventSystemTest, eventsystem_send_user_event) {
-  tizen_base::Bundle data;
-  int ret = eventsystem_send_user_event("event.test", data.GetHandle(), false);
-  EXPECT_EQ(ret, ES_R_OK);
-}
-
 TEST_F(EventSystemTest, eventsystem_send_system_event) {
   tizen_base::Bundle data;
   int ret = eventsystem_send_system_event("tizen.system.event.test",

diff --git a/tests/unit_tests/eventsystem_test.cc b/tests/unit_tests/eventsystem_test.cc
index 30b00f0d5d3d42cba3c308148554e9d6963001a7..80d0975f442d5d15f65027cc7c3ab692175e1508 100644 (file)
--- a/tests/unit_tests/eventsystem_test.cc
+++ b/tests/unit_tests/eventsystem_test.cc
@@ -177,8 +177,16 @@ TEST_F(EventSystemTest, eventsystem_unregister_event) {
 
 TEST_F(EventSystemTest, eventsystem_send_user_event) {
   tizen_base::Bundle data;
+  EXPECT_CALL(GetMock<RpcPortMock>(), rpc_port_get_peer_info(_, _, _))
+      .WillRepeatedly(Invoke([](rpc_port_h, pid_t* pid, uid_t* uid) {
+        if (pid) *pid = getpid();
+        if (uid) *uid = 5001;
+        return 0;
+      }));
+
   RunModule();
-  int ret = eventsystem_send_user_event("event.test", data.GetHandle(), false);
+  int ret = eventsystem_send_user_event(
+      "event.d::org.tizen.appfw.service.esd.test", data.GetHandle(), false);
   EXPECT_EQ(ret, ES_R_OK);
 }
 
@@ -988,7 +996,7 @@ TEST_F(EventSystemTest, eventsystem_launch_event_user_event1) {
               pkgmgrinfo_appinfo_foreach_appcontrol(_, _, _))
       .WillOnce(Invoke([](auto handle, pkgmgrinfo_app_control_list_cb callback,
                           void* user_data) {
-        std::string uri = "event.test";
+        std::string uri = "event.d::org.tizen.appfw.service.esd.test";
         callback(AUL_SVC_OPERATION_LAUNCH_ON_EVENT, uri.c_str(), "test_mime",
                  user_data);
         return 0;
@@ -996,12 +1004,18 @@ TEST_F(EventSystemTest, eventsystem_launch_event_user_event1) {
   EXPECT_CALL(GetMock<AulMock>(),
               aul_svc_run_service_async_for_uid(_, _, _, _, _))
       .Times(1);
+  EXPECT_CALL(GetMock<RpcPortMock>(), rpc_port_get_peer_info(_, _, _))
+      .WillRepeatedly(Invoke([](rpc_port_h, pid_t* pid, uid_t* uid) {
+        if (pid) *pid = getpid();
+        if (uid) *uid = 5001;
+        return 0;
+      }));
 
   RunModule();
   g_event_name = "";
   loop = g_main_loop_new(nullptr, FALSE);
   int ret = eventsystem_register_application_event(
-      "event.test", &id, &type,
+      "event.d::org.tizen.appfw.service.esd.test", &id, &type,
       [](const char* event_name, bundle_raw* event_data, int len,
          void* user_data) {
         g_event_name = event_name;
@@ -1010,10 +1024,11 @@ TEST_F(EventSystemTest, eventsystem_launch_event_user_event1) {
       nullptr);
   EXPECT_EQ(ret, ES_R_OK);
   tizen_base::Bundle data;
-  eventsystem_send_user_event("event.test", data.GetHandle(), false);
+  eventsystem_send_user_event("event.d::org.tizen.appfw.service.esd.test",
+                              data.GetHandle(), false);
   g_main_loop_run(loop);
 
-  EXPECT_EQ(g_event_name, "event.test");
+  EXPECT_EQ(g_event_name, "event.d::org.tizen.appfw.service.esd.test");
   g_main_loop_unref(loop);
 }
 
@@ -1027,7 +1042,7 @@ TEST_F(EventSystemTest, eventsystem_launch_event_user_event2) {
               pkgmgrinfo_appinfo_foreach_appcontrol(_, _, _))
       .WillOnce(Invoke([](auto handle, pkgmgrinfo_app_control_list_cb callback,
                           void* user_data) {
-        std::string uri = "event.test";
+        std::string uri = "event.d::org.tizen.appfw.service.esd.test";
         callback(AUL_SVC_OPERATION_LAUNCH_ON_EVENT, uri.c_str(), "test_mime",
                  user_data);
         return 0;
@@ -1042,12 +1057,18 @@ TEST_F(EventSystemTest, eventsystem_launch_event_user_event2) {
   EXPECT_CALL(GetMock<AulMock>(),
               aul_svc_run_service_async_for_uid(_, _, _, _, _))
       .Times(1);
+  EXPECT_CALL(GetMock<RpcPortMock>(), rpc_port_get_peer_info(_, _, _))
+      .WillRepeatedly(Invoke([](rpc_port_h, pid_t* pid, uid_t* uid) {
+        if (pid) *pid = getpid();
+        if (uid) *uid = 5001;
+        return 0;
+      }));
 
   RunModule();
   g_event_name = "";
   loop = g_main_loop_new(nullptr, FALSE);
   int ret = eventsystem_register_application_event(
-      "event.test", &id, &type,
+      "event.d::org.tizen.appfw.service.esd.test", &id, &type,
       [](const char* event_name, bundle_raw* event_data, int len,
          void* user_data) {
         g_event_name = event_name;
@@ -1056,9 +1077,10 @@ TEST_F(EventSystemTest, eventsystem_launch_event_user_event2) {
       nullptr);
   EXPECT_EQ(ret, ES_R_OK);
   tizen_base::Bundle data;
-  eventsystem_send_user_event("event.test", data.GetHandle(), true);
+  eventsystem_send_user_event("event.d::org.tizen.appfw.service.esd.test",
+                              data.GetHandle(), true);
   g_main_loop_run(loop);
 
-  EXPECT_EQ(g_event_name, "event.test");
+  EXPECT_EQ(g_event_name, "event.d::org.tizen.appfw.service.esd.test");
   g_main_loop_unref(loop);
 }

diff --git a/tests/unit_tests/mock/rpc_port_mock.cc b/tests/unit_tests/mock/rpc_port_mock.cc
index 1019123ab7d3116f82e9d5203e9c5128c65fbfbc..7c78ea91728c43d9623704f35cd07476e7348e5d 100644 (file)
--- a/tests/unit_tests/mock/rpc_port_mock.cc
+++ b/tests/unit_tests/mock/rpc_port_mock.cc
@@ -25,4 +25,8 @@ extern "C" int rpc_port_register_proc_info(const char* arg0, bundle* arg1) {
 
 extern "C" int rpc_port_stub_listen(rpc_port_stub_h h) {
   return MOCK_HOOK_P1(RpcPortMock, rpc_port_stub_listen, h);
+}
+
+extern "C" int rpc_port_get_peer_info(rpc_port_h h, pid_t* pid, uid_t* uid) {
+  return MOCK_HOOK_P3(RpcPortMock, rpc_port_get_peer_info, h, pid, uid);
 }
\ No newline at end of file

diff --git a/tests/unit_tests/mock/rpc_port_mock.hh b/tests/unit_tests/mock/rpc_port_mock.hh
index 862b0b627dc2aae4ce6ec725fd5ca9b116f5503a..502d83d7ce3e689acdb98ba227ec668ec7421dff 100644 (file)
--- a/tests/unit_tests/mock/rpc_port_mock.hh
+++ b/tests/unit_tests/mock/rpc_port_mock.hh
@@ -26,10 +26,23 @@
 
 class RpcPortMock : public virtual ModuleMock {
  public:
+  RpcPortMock() {
+    using ::testing::_;
+    using ::testing::Invoke;
+
+    ON_CALL(*this, rpc_port_get_peer_info(_, _, _))
+        .WillByDefault(Invoke([](rpc_port_h, pid_t* pid, uid_t* uid) {
+          if (pid) *pid = getpid();
+          if (uid) *uid = getuid();
+          return 0;
+        }));
+  }
+
   virtual ~RpcPortMock() {}
 
   MOCK_METHOD2(rpc_port_register_proc_info, int(const char*, bundle*));
   MOCK_METHOD1(rpc_port_stub_listen, int(rpc_port_stub_h));
+  MOCK_METHOD3(rpc_port_get_peer_info, int(rpc_port_h, pid_t*, uid_t*));
 };
 
 #endif  // MOCK_RPC_PORT_MOCK_H_