[can-xin]

run_action concatenates the module id into /data/adb/modules/{id}/action.sh with no validation. .. in the id is resolved, so the action script can sit outside the module directory and is executed as root. A local app can use this to escalate to root. For example:

am start -n me.yuki.folk/me.bmax.apatch.ui.MainActivity \
  --ez from_action_shortcut true \
  --es apm_action_module_id '../../../data/local/tmp/poc'  # adb shell test command; the path can also point at an app's private directory

Reject ids that do not match the same pattern already used at zip install.