file_path from main_entry.txt inside the bugreport zip is device controlled
and was used directly to open files on the host without validation.
Validate the resolved path stays within extract_path using
Path.resolve() + is_relative_to() before opening. Unsafe paths raise
ValueError and abort the operation.
Fixes GHSA-58fm-wv78-6929
file_id values from backup manifests are device controlled and were used
directly to construct host filesystem paths without validation, allowing
a malicious backup to read or write files outside the designated directories.
Validate each file_id with Path.resolve() + is_relative_to() before use
as a source or destination path. Unsafe entries are skipped and logged.
Fixes GHSA-5h3g-px23-w6vw
