1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License"){return 0;}
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #define MLOG_TAG "MediaPermissionCheck"
16 #include <string>
17 #include "media_db_permission_check.h"
18 #include "medialibrary_bundle_manager.h"
19
20 using namespace std;
21 namespace OHOS::Media {
22 static const std::string TABLE_PERMISSION = "UriPermission"; // 权限表
23 static const std::string FIELD_PERMISSION_TYPE = "permission_type";
24
GetPermissionType(uint32_t code,const PermissionHeaderReq & request,int32_t & permissionType)25 int32_t DbPermissionCheck::GetPermissionType(uint32_t code, const PermissionHeaderReq &request,
26 int32_t &permissionType)
27 {
28 MEDIA_INFO_LOG("DbPermissionHandler enter");
29 string fileId = request.getFileId();
30 if (fileId.empty()) {
31 MEDIA_ERR_LOG("invalid fileId input");
32 return E_INVALID_FILEID;
33 }
34 int32_t uriType = request.getUriType();
35 string appId = PermissionUtils::GetAppIdByBundleName(
36 MediaLibraryBundleManager::GetInstance()->GetClientBundleName());
37 uint32_t tokenId = PermissionUtils::GetTokenId();
38 MEDIA_DEBUG_LOG("appId=%{public}s,fileId=%{public}s", appId.c_str(), fileId.c_str());
39 if ((appId.empty() && !tokenId)) {
40 MEDIA_ERR_LOG("invalid input");
41 return E_INVALID_FILEID;
42 }
43 DataShare::DataSharePredicates predicates;
44 predicates.SetWhereClause("file_id = ? and (appid = ? or target_tokenId = ?) and uri_type = ?"
45 " order by permission_type desc");
46 predicates.SetWhereArgs({fileId, appId, to_string(tokenId), to_string(uriType)});
47 vector<string> columns;
48 auto queryResultSet = MediaLibraryRdbStore::QueryWithFilter(
49 RdbDataShareAdapter::RdbUtils::ToPredicates(predicates, TABLE_PERMISSION), columns);
50 CHECK_AND_RETURN_RET_LOG(queryResultSet != nullptr, E_PERMISSION_DENIED, "queryResultSet is nullptr");
51 int count = 0;
52 auto ret = queryResultSet->GetRowCount(count);
53 CHECK_AND_RETURN_RET_LOG(ret == NativeRdb::E_OK && count > 0,
54 E_PERMISSION_DENIED, "db is no permission record");
55 ret = queryResultSet->GoToFirstRow();
56 CHECK_AND_RETURN_RET_LOG(ret == NativeRdb::E_OK, E_PERMISSION_DENIED, "GoToFirstRow fail");
57 int index = -1;
58 ret = queryResultSet->GetColumnIndex(FIELD_PERMISSION_TYPE, index);
59 CHECK_AND_RETURN_RET_LOG(ret == NativeRdb::E_OK, E_PERMISSION_DENIED, "GetColumnIndex fail");
60
61 ret = queryResultSet->GetInt(index, permissionType);
62 CHECK_AND_RETURN_RET_LOG(ret == NativeRdb::E_OK, E_PERMISSION_DENIED, "GetInt fail");
63 return E_SUCCESS;
64 }
65
CheckDBPermissionBypass(uint32_t code,const PermissionHeaderReq & request)66 int32_t DbPermissionCheck::CheckDBPermissionBypass(uint32_t code, const PermissionHeaderReq &request)
67 {
68 MEDIA_INFO_LOG("CheckDBPermissionBypass enter");
69 uint32_t tokenId = PermissionUtils::GetTokenId();
70 CHECK_AND_RETURN_RET_LOG(tokenId, E_PERMISSION_DENIED, "Get tokenId fail");
71
72 DataShare::DataSharePredicates predicates;
73 predicates.SetWhereClause("target_tokenId = ? order by permission_type desc");
74 predicates.SetWhereArgs({to_string(tokenId)});
75 vector<string> columns;
76 auto queryResultSet = MediaLibraryRdbStore::QueryWithFilter(
77 RdbDataShareAdapter::RdbUtils::ToPredicates(predicates, TABLE_PERMISSION), columns);
78 CHECK_AND_RETURN_RET_LOG(queryResultSet != nullptr, E_PERMISSION_DENIED, "queryResultSet is nullptr");
79 int count = 0;
80 auto ret = queryResultSet->GetRowCount(count);
81 CHECK_AND_RETURN_RET_LOG(ret == NativeRdb::E_OK && count > 0, E_PERMISSION_DENIED, "db is no permission record");
82 return E_PERMISSION_DB_BYPASS;
83 }
84 } // namespace OHOS::Media
85