The socket path will be included in a shell command and then as a socat argument, so only allow a small subset of known-safe characters. In practice, this has not been a problem because mktemp doesn’t include these characters in its output.