Just for future reference, and as given in docs, the correct way of importing safe_join nowadays is:

from werkzeug.security import safe_join

Which:

Safely join zero or more untrusted path components to a base directory to avoid escaping the base directory.