PLT-7407: Back-end plugins (#7409)

* tie back-end plugins together

* fix comment typo

* add tests and a bit of polish

* tests and polish

* add test, don't let backend executable paths escape the plugin directory

plugin/rpcplugin/supervisor.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"path/filepath"
+	"strings"
 	"sync/atomic"
 	"time"
 
@@ -123,7 +124,11 @@ func SupervisorProvider(bundle *model.BundleInfo) (plugin.Supervisor, error) {
 	} else if bundle.Manifest.Backend == nil || bundle.Manifest.Backend.Executable == "" {
 		return nil, fmt.Errorf("no backend executable specified")
 	}
+	executable := filepath.Clean(filepath.Join(".", bundle.Manifest.Backend.Executable))
+	if strings.HasPrefix(executable, "..") {
+		return nil, fmt.Errorf("invalid backend executable")
+	}
 	return &Supervisor{
-		executable: filepath.Join(bundle.Path, bundle.Manifest.Backend.Executable),
+		executable: filepath.Join(bundle.Path, executable),
 	}, nil
 }