pub fn join_under(base: &Path, logical: &Path) -> PathBuf
Join a logical absolute path onto a real directory, refusing anything that would land outside of it.