The `Pathanme.cleanpath` is supposed to canonicalize such malicious paths so the test for `..` should be sufficient.
The rubygems' tar code uses similar approach utilizing the `File.expand_path` to canonicalize the path and subsequently making sure the start of the path matches the expected install directory, see here:
https://github.com/rubygems/rubygems/blob/master/lib/rubygems/package.rb#L368-L378