fix: validate manifest collection names and route archive accessors through safeJoin

shared/backup/archive.go

@@ -201,7 +201,7 @@ func (r *Reader) loadManifest() error {
 
 func (r *Reader) verifyMembers() error {
 	for _, c := range r.manifest.Collections {
-		f, err := os.Open(filepath.Join(r.dir, collectionMember(c.Name)))
+		f, err := r.OpenCollection(c.Name)
 		if err != nil {
 			return fmt.Errorf("%w: %s is named in the manifest but absent from the archive",
 				ErrChecksum, c.Name)
@@ -227,14 +227,22 @@ func (r *Reader) Manifest() Manifest { return r.manifest }
 
 // OpenCollection returns the raw BSON stream for one collection.
 func (r *Reader) OpenCollection(name string) (io.ReadCloser, error) {
-	return os.Open(filepath.Join(r.dir, collectionMember(name)))
+	p, err := safeJoin(r.dir, collectionMember(name))
+	if err != nil {
+		return nil, err
+	}
+	return os.Open(p)
 }
 
 // IndexesJSON returns a collection's index specifications, or nil when the
 // archive holds none. A collection with no indexes beyond _id_ is ordinary and
 // is not an error.
 func (r *Reader) IndexesJSON(name string) ([]byte, error) {
-	raw, err := os.ReadFile(filepath.Join(r.dir, indexMember(name)))
+	p, err := safeJoin(r.dir, indexMember(name))
+	if err != nil {
+		return nil, err
+	}
+	raw, err := os.ReadFile(p)
 	if os.IsNotExist(err) {
 		return nil, nil
 	}