NuttX is not affected by GHSA-93v7-287q-qx4g: it has a flat VFS, the
FAT driver used for /fs/microsd does not support symlinks, and
CONFIG_PSEUDOFS_SOFTLINKS is off by default. Running realpath() and
parent canonicalization there is dead weight that costs flash for no
security benefit.
Move the canonicalize_path helper, the in-root check, the new
includes, and O_NOFOLLOW behind #ifndef __PX4_NUTTX so the NuttX
build is functionally identical to main, except that _workOpen and
_workWrite now also call _validatePathIsWritable for write paths
(matching the pattern already used by the other writable opcodes).
On POSIX/SITL the symlink-resolution hardening is unchanged.
Drop the now-unused _validatePathIsInRoot declaration from the
header.
Signed-off-by: Ramon Roche <mrpollo@gmail.com>
Ramon Roche
419c5535a8