validate_path should only reject sudirs named ".."
Subdirs contaning ".." in the dir name should be valid
e.g. "example..com"
Bug: 361246509
Test: atest installd_utils_test
Flag: EXEMPT bug fix
Change-Id: I1896cde831c20289490187dc1b45c04461e5d849
diff --git a/cmds/installd/utils.cpp b/cmds/installd/utils.cpp
index ffc082d..b05c655 100644
--- a/cmds/installd/utils.cpp
+++ b/cmds/installd/utils.cpp
@@ -1040,25 +1040,30 @@
LOG(ERROR) << "Invalid directory " << dir;
return -1;
}
- if (path.find("..") != std::string::npos) {
- LOG(ERROR) << "Invalid path " << path;
- return -1;
- }
if (path.compare(0, dir.size(), dir) != 0) {
// Common case, path isn't under directory
return -1;
}
- // Count number of subdirectories
- auto pos = path.find('/', dir.size());
+ // Count number of subdirectories and invalidate ".." subdirectories
+ auto last = dir.size();
+ auto pos = path.find('/', last);
int count = 0;
while (pos != std::string::npos) {
- auto next = path.find('/', pos + 1);
- if (next > pos + 1) {
+ if (pos > last + 1) {
count++;
}
- pos = next;
+ if (path.substr(last, pos - last) == "..") {
+ LOG(ERROR) << "Invalid path " << path;
+ return -1;
+ }
+ last = pos + 1;
+ pos = path.find('/', last);
+ }
+ if (path.substr(last, path.size() - last) == "..") {
+ LOG(ERROR) << "Invalid path " << path;
+ return -1;
}
if (count > maxSubdirs) {