interfaces/innerkits/ipc_core/include/iremote_object.h

@@ -45,7 +45,7 @@ public:
     enum {
         DATABUS_TYPE,
     };
-    class DeathRecipient : public RefBase {
+    class DeathRecipient : public virtual RefBase {
     public:
        /**
         * @brief Methods that enumerate death notifications.

ipc/native/src/napi/src/napi_ipc_skeleton.cpp

@@ -30,6 +30,7 @@ static NapiError napiErr;
 
 static const size_t ARGV_INDEX_0 = 0;
 static const size_t ARGV_INDEX_1 = 1;
+static constexpr size_t UINT64_STRING_MAX_LEN = 20;
 
 napi_value NAPI_IPCSkeleton_getContextObject(napi_env env, napi_callback_info info)
 {
@@ -249,6 +250,20 @@ napi_value NAPI_IPCSkeleton_resetCallingIdentity(napi_env env, napi_callback_inf
     }
 }
 
+static bool IsValidIdentity(const std::string &identity)
+{
+    // 20 represents the maximum string length uint64_t can represent
+    if (identity.empty() || identity.length() > UINT64_STRING_MAX_LEN) {
+        return false;
+    }
+
+    auto predicate = [](char c) {
+        return isdigit(c) == 0;
+    };
+    auto it = std::find_if(identity.begin(), identity.end(), predicate);
+    return it == identity.end();
+}
+
 napi_value NAPI_IPCSkeleton_setCallingIdentity(napi_env env, napi_callback_info info)
 {
     napi_value global = nullptr;
@@ -291,7 +306,7 @@ napi_value NAPI_IPCSkeleton_setCallingIdentity(napi_env env, napi_callback_info
     napi_get_value_bool(env, napiIsLocalCalling, &isLocalCalling);
     napi_value result;
     if (isLocalCalling) {
-        if (identity.empty()) {
+        if (!IsValidIdentity(identity)) {
             napi_get_boolean(env, false, &result);
             return result;
         }
@@ -314,7 +329,12 @@ napi_value NAPI_IPCSkeleton_setCallingIdentity(napi_env env, napi_callback_info
         }
 
         std::string deviceId = identity.substr(0, DEVICEID_LENGTH);
-        int64_t token = std::stoll(identity.substr(DEVICEID_LENGTH, identity.length() - DEVICEID_LENGTH));
+        const std::string readIdentity = identity.substr(DEVICEID_LENGTH, identity.length() - DEVICEID_LENGTH);
+        if (!IsValidIdentity(readIdentity)) {
+            napi_get_boolean(env, false, &result);
+            return result;
+        }
+        int64_t token = std::stoll(readIdentity);
         int callerUid = static_cast<int>((static_cast<uint64_t>(token)) >> PID_LEN);
         int callerPid = static_cast<int>(token);
         napi_value napiCallingPid;
@@ -343,7 +363,7 @@ static napi_value NAPI_IPCSkeleton_restoreCallingIdentitySetProperty(napi_env en
     napi_value result;
     napi_get_undefined(env, &result);
     if (isLocalCalling) {
-        if (identity.empty()) {
+        if (!IsValidIdentity(identity)) {
             ZLOGE(LOG_LABEL, "identity is empty");
             return result;
         }
@@ -365,7 +385,12 @@ static napi_value NAPI_IPCSkeleton_restoreCallingIdentitySetProperty(napi_env en
         }
 
         std::string deviceId = identity.substr(0, DEVICEID_LENGTH);
-        int64_t token = std::stoll(identity.substr(DEVICEID_LENGTH, identity.length() - DEVICEID_LENGTH));
+        const std::string readIdentity = identity.substr(DEVICEID_LENGTH, identity.length() - DEVICEID_LENGTH);
+        if (!IsValidIdentity(readIdentity)) {
+            ZLOGE(LOG_LABEL, "readIdentity is invalid");
+            return result;
+        }
+        int64_t token = std::stoll(readIdentity);
         int callerUid = static_cast<int>((static_cast<uint64_t>(token)) >> PID_LEN);
         int callerPid = static_cast<int>(token);
         napi_value napiCallingPid;

ipc/native/src/napi_common/include/napi_remote_object_holder.h

@@ -27,7 +27,7 @@ namespace OHOS {
 class NAPIRemoteObjectHolder : public RefBase {
 public:
     explicit NAPIRemoteObjectHolder(napi_env env, const std::u16string &descriptor, napi_value thisVar);
-    ~NAPIRemoteObjectHolder() = default;
+    ~NAPIRemoteObjectHolder();
     sptr<IRemoteObject> Get();
     void Set(sptr<IRemoteObject> object);
     void attachLocalInterface(napi_value localInterface, std::string &descriptor);

ipc/native/src/napi_common/source/napi_remote_object.cpp

@@ -181,17 +181,6 @@ static NativeValue *RemoteObjectAttachCb(NativeEngine *engine, void *value, void
     return reinterpret_cast<NativeValue *>(jsRemoteObject);
 }
 
-static void OnEnvCleanUp(void *data)
-{
-    if (data == nullptr) {
-        ZLOGE(LOG_LABEL, "data is null");
-        return;
-    }
-    NAPIRemoteObjectHolder *holder = reinterpret_cast<NAPIRemoteObjectHolder *>(data);
-    // js env has been destrcted, clear saved env info, and check befor use it
-    holder->CleanJsEnv();
-}
-
 napi_value RemoteObject_JS_Constructor(napi_env env, napi_callback_info info)
 {
     // new napi remote object
@@ -224,9 +213,6 @@ napi_value RemoteObject_JS_Constructor(napi_env env, napi_callback_info info)
     // connect native object to js thisVar
     napi_status status = napi_wrap(env, thisVar, holder, RemoteObjectHolderFinalizeCb, nullptr, nullptr);
     NAPI_ASSERT(env, status == napi_ok, "wrap js RemoteObject and native holder failed");
-    // register listener for env destruction
-    status = napi_add_env_cleanup_hook(env, OnEnvCleanUp, holder);
-    NAPI_ASSERT(env, status == napi_ok, "add cleanup hook failed");
     return thisVar;
 }
 

ipc/native/src/napi_common/source/napi_remote_object_holder.cpp

@@ -23,10 +23,16 @@
 namespace OHOS {
 static constexpr OHOS::HiviewDFX::HiLogLabel LOG_LABEL = { LOG_CORE, LOG_ID_IPC, "napi_remoteObject_holder" };
 
-struct DeleteJsRefParam {
-    napi_env env;
-    napi_ref thisVarRef;
-};
+static void OnEnvCleanUp(void *data)
+{
+    if (data == nullptr) {
+        ZLOGE(LOG_LABEL, "data is null");
+        return;
+    }
+    NAPIRemoteObjectHolder *holder = reinterpret_cast<NAPIRemoteObjectHolder *>(data);
+    // js env has been destrcted, clear saved env info, and check befor use it
+    holder->CleanJsEnv();
+}
 
 NAPIRemoteObjectHolder::NAPIRemoteObjectHolder(napi_env env, const std::u16string &descriptor, napi_value thisVar)
     : env_(env), descriptor_(descriptor), sptrCachedObject_(nullptr), wptrCachedObject_(nullptr),
@@ -36,6 +42,22 @@ NAPIRemoteObjectHolder::NAPIRemoteObjectHolder(napi_env env, const std::u16strin
     // create weak ref, do not need to delete,
     // increase ref count when the JS object will transfer to another thread or process.
     napi_create_reference(env, thisVar, 0, &jsObjectRef_);
+
+    // register listener for env destruction
+    napi_status status = napi_add_env_cleanup_hook(env, OnEnvCleanUp, this);
+    if (status != napi_ok) {
+        ZLOGE(LOG_LABEL, "add cleanup hook failed");
+    }
+}
+
+NAPIRemoteObjectHolder::~NAPIRemoteObjectHolder()
+{
+    if (env_ != nullptr) {
+        napi_status status = napi_remove_env_cleanup_hook(env_, OnEnvCleanUp, this);
+        if (status != napi_ok) {
+            ZLOGE(LOG_LABEL, "remove cleanup hook failed");
+        }
+    }
 }
 
 sptr<IRemoteObject> NAPIRemoteObjectHolder::Get()