openharmony-security-review

SKILL.md

OpenHarmony system services run with high privileges and handle untrusted inputs via IPC and network interfaces. This skill provides a structured approach to identifying critical security vulnerabilities in four key areas: external input handling, multithreading race conditions, sensitive information leakage, and permission validation.

Header file input (.h/.hpp): Analyze corresponding xxxService.cpp and xxxStub.cpp Stub file input (xxxStub.cpp): Extend analysis to xxxService.cpp (core logic + shared state) External calls: Flag cross-component concurrency risks for separate review

| IPC Deserialization | All MessageParcel reads checked for success | HIGH | | Logical Validation | Array lengths/indices validated AFTER deserialization | HIGH | | Integer Bounds | Size variables: 0 <= size <= MAXALLOWEDBUFFER | HIGH | | Object Lifecycle | RemoteObjects/fd validated before use (nullptr check) | HIGH |

查看原文