The obtained strings are passed to another function, e,g, handled as a path and opened, printed to the terminal, written to a file, saved to udev database as udev property, exposed through DBus, passed to logger, and so on. Hence, these should not contain any malicious characters.