fix: correct verify's ciphertext field map against the models

backup/manifest_test.go

@@ -69,7 +69,7 @@ func TestManifestCollectionLookup(t *testing.T) {
 
 func TestCiphertextCollections(t *testing.T) {
 	got := CiphertextCollections()
-	want := []string{"keys", "secrets", "auth_providers", "console_sessions", "settings"}
+	want := []string{"keys", "secrets", "auth_providers", "console_sessions"}
 	if len(got) != len(want) {
 		t.Fatalf("got %v, want %v", got, want)
 	}
@@ -79,3 +79,25 @@ func TestCiphertextCollections(t *testing.T) {
 		}
 	}
 }
+
+// TestManifestRefusesUnusableCollectionNames covers names being used as path
+// components inside the extraction directory. An archive is operator-supplied
+// input and may not be one we wrote.
+func TestManifestRefusesUnusableCollectionNames(t *testing.T) {
+	for _, name := range []string{"", ".", "..", "../etc/passwd", "a/b", "a..b"} {
+		m := Manifest{
+			FormatVersion: FormatVersion,
+			Collections:   []CollectionEntry{{Name: name}},
+		}
+		if err := m.Check(); !errors.Is(err, ErrBadCollectionName) {
+			t.Fatalf("collection name %q was accepted (err %v)", name, err)
+		}
+	}
+	m := Manifest{
+		FormatVersion: FormatVersion,
+		Collections:   []CollectionEntry{{Name: "workflow_log_lines"}},
+	}
+	if err := m.Check(); err != nil {
+		t.Fatalf("an ordinary collection name was refused: %v", err)
+	}
+}