followup to #4202

this is an potential issue and attack vector, absolute paths are no tmpdir and escaping paths aren't either,
just normalizing would also break the world

so we should only ever accept normalized relative paths for it