Add security to local directory setup

backend/setup_data_dir.go

@@ -14,6 +14,10 @@ func setupDataDir() (string, error) {
 		dataDir = filepath.Join(".", os.Getenv("DATA_DIR"))
 	}
 
+	if !filepath.IsLocal(dataDir) {
+		return "", fmt.Errorf("directory '%s' is not valid or not local", dataDir)
+	}
+
 	if _, err := os.Stat(dataDir); os.IsNotExist(err) {
 		err := os.Mkdir(dataDir, 0o755)
 		if err != nil {