commit dfb2e27ae212cfd1ea34d47de53d312d1c716924
author Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com> Wed Oct 12 16:20:12 2022 +0530
committer Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com> Mon Nov 28 15:10:06 2022 +0530
tree 6d4162d7ff48407b2bac4add55bab5e3d88a58b9
parent 77d16aceae884db5382a203e538827e6ee205051

USB: Solving path traversal issue in USB HAL AppendNodeMapper

Currently the string comes from the HIDL interface and
attackers can access this HAL via HWBinder once escalated
they can cause this path traversal by sending any string
such as "../../../data/local/temp". In this patch, a condition
is added that looks specifically for '/' & '..' and returns a
empty string if it is found otherwise string will be append to
"/sys/class/typec/" to map the portName we receive from HIDL interface.

Change-Id: Id9c6cd0fc2360da5ffe31dbecc2bf4978b085b58