Python safepath to replace os.path.join when you don't want the path components to tmp outside a root path preventing path traversal.

safepath.py

def safepath_join(head, *tail):
    """
    combines path parts like os.path.join, but ensures the resultant directory 
    doesn't step outside of the path given as the root.
    """
    root = os.path.abspath(head)
    p = os.path.normpath(os.path.join(head, *tail))
    if not p.startswith(root + os.path.sep):
        raise ValueError(f"{p} steps outside {root}")
    return p