helper: fix security hole in is_path_safe()