magiclf-ai/ivagent/arkts-ability-hijack

interface Want {
  bundleName?: string;    // 目标包名
  abilityName?: string;   // 目标 Ability 名
  action?: string;        // 动作
  parameters?: {          // 参数 (污点源)
    [key: string]: any;
  };
}

// 危险：未指定 bundleName/abilityName
router.pushUrl({ url: 'pages/Index', params: userData });

// 危险：直接使用传入的 Want 参数
onCreate(want: Want) {
  let nestedWant = want.parameters?.nested;
  this.context.startAbility(nestedWant);
}

export default class EntryAbility extends UIAbility {
  onCreate(want: Want, launchParam: AbilityConstant.LaunchParam): void {
    // want.parameters 是主要污点源
    let userData = want.parameters?.userData;
  }
}

import router from '@ohos.router';
// 获取路由参数
let params = router.getParams();
// params 来自用户输入，需要验证