commit 28a3fb32135cd5769c2e7ff4a4cb104add328b8c
author Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com> Wed Oct 12 16:20:12 2022 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue Nov 29 21:24:02 2022 -0800
tree e8f74559cdd5619e93c56cb801fdfcde83a63ec4
parent 93576eea98913301f18386035eefcb23935cc32c

USB: Solving path traversal issue in USB HAL AppendNodeMapper

Currently the string comes from the HIDL interface and
attackers can access this HAL via HWBinder once escalated
they can cause this path traversal by sending any string
such as "../../../data/local/temp". In this patch, a condition
is added that looks specifically for '/' & '..' and returns a
empty string if it is found otherwise string will be append to
"/sys/class/typec/" to map the portName we receive from HIDL interface.

Change-Id: Id9c6cd0fc2360da5ffe31dbecc2bf4978b085b58