enh(backup): harden file type and name constraints on restore

[MichaIng]

Once we support Python 3.12+ only, we can use filter='data' instead, or additionally, which refuses to extract any kind of link, normalizes paths, skips owner/mode, and more more. With our hardcoded strict filename pattern and the isfile() check, however, all security concerns are addressed.

[Copilot]

Pull request overview

Tightens backup restore behavior in motioneye.config.restore() by restricting extraction to regular files during tarball restore, aiming to reduce risk from non-file tar members.

Changes:

• Filter tar members using TarInfo.isfile() before applying the allowed filename patterns.
• Keep existing pattern-based allowlist for config-related filenames during restore.

[MichaIng]

@copilot
Does 27a80e7 really add anything in terms of security?

• In tarfile.member.name, path elements are always represented in UNIX style as /. \ would be a literal character in the file basename.
• If a member is not readable, extractall() would fail, but not cause a security issue.
• As we skip on members with / (path elements) in their name, other than leading ./ segments, I see no way how anything can be extracted to anything other than os.path.join(settings.CONF_PATH, name) anyway.

Hence the loop added to extract every file individually seems to not actually add anything to security, but adds quite a lot of unnecessary processing. If so, we better keep it as it was and use # nosec B202 for now.

[Copilot]

@copilot
Does 27a80e7 really add anything in terms of security?

• In tarfile.member.name, path elements are always represented in UNIX style ...

Agreed, and adjusted in e02b162. I reverted the per-file extraction loop and switched back to tf.extractall(settings.CONF_PATH, members=members) # nosec B202, while keeping the expanded regression tests for non-regular members, absolute paths, and path-element wildcard abuse.

[MichaIng]

@copilot
Please apply the same logic applied with e369bb4 for backup/tarball member tests: assert that the full list of tarball members matches the list of expected members, instead of asserting for individual names whether they have or have not been added.

[Copilot]

@copilot
Please apply the same logic applied with e369bb4 for backup/tarball member tests: assert that the full list of tarbal...

Done in a621b98. Added _assert_tarball_members helper and replaced all scattered assertIn/assertNotIn checks in TestBackup with a single exact-list assertion per test.