Turning "/srv//app/./logs/../data/" into "/srv/app/data" is everyday path handling, and getting it wrong causes path-traversal security bugs, where ../../etc/passwd escapes the folder you meant to allow.
Implement normalize(path) for POSIX-style paths:
. segments, and resolve .. by removing the previous segment./), .. at the root stays at the root. For relative paths, leading .. segments that can't be resolved are kept."/"). An empty relative result is ".".Then implement is_safe_join(base, user_path): True if joining the relative user_path onto the absolute base and normalising stays inside base. Absolute user_path values are never safe. Don't use os.path or pathlib.