ipn/ipnlocal: perform additional sanity check in diskPath (#9500)

Use filepath.IsLocal to further validate the baseName.

Updates tailscale/corp#14772

Signed-off-by: Joe Tsai <joetsai@digital-static.net>

ipn/ipnlocal/peerapi.go

@@ -136,6 +136,9 @@ func (s *peerAPIServer) diskPath(baseName string) (fullPath string, ok bool) {
 			return "", false
 		}
 	}
+	if !filepath.IsLocal(baseName) {
+		return "", false
+	}
 	return filepath.Join(s.rootDir, baseName), true
 }