commit 09dbf6f20e315b3d2317c7a9b8bcea7aa8204d95
author Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com> Wed Oct 12 16:20:12 2022 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue Dec 06 23:13:14 2022 -0800
tree 5bc75a644443607bf4298c8ab7c0c6ed66cce3b1
parent 71fbe98d304a4dd0608e9fd4c245a65eff16bcff

USB: Solving path traversal issue in USB HAL AppendNodeMapper

Currently the string comes from the HIDL interface and
attackers can access this HAL via HWBinder once escalated
they can cause this path traversal by sending any string
such as "../../../data/local/temp". In this patch, a condition
is added that looks specifically for '/' & '..' and returns a
empty string if it is found otherwise string will be append to
"/sys/class/typec/" to map the portName we receive from HIDL interface.

Change-Id: Id9c6cd0fc2360da5ffe31dbecc2bf4978b085b58

hal/Usb.cpp

diff --git a/hal/Usb.cpp b/hal/Usb.cpp
index 8a4afae..1cf2a5a 100644
--- a/hal/Usb.cpp
+++ b/hal/Usb.cpp
@@ -107,17 +107,23 @@
 
 std::string appendRoleNodeHelper(const std::string &portName,
                                  PortRoleType type) {
-  std::string node("/sys/class/typec/" + portName);
 
-  switch (type) {
-    case PortRoleType::DATA_ROLE:
-      return node + "/data_role";
-    case PortRoleType::POWER_ROLE:
-      return node + "/power_role";
-    case PortRoleType::MODE:
-      return node + "/port_type";
-    default:
-      return "";
+    if ((portName == "..") || (portName.find('/') != std::string::npos)) {
+       ALOGE("Fatal: invalid portName");
+       return "";
+    }
+
+    std::string node("/sys/class/typec/" + portName);
+
+    switch (type) {
+      case PortRoleType::DATA_ROLE:
+        return node + "/data_role";
+      case PortRoleType::POWER_ROLE:
+        return node + "/power_role";
+      case PortRoleType::MODE:
+        return node + "/port_type";
+      default:
+        return "";
   }
 }