@mruzicka I'm not sure this is sufficient, what about a malicious path of `./../../`? The rubygems' tar code has similar logic for checking that we don't escape the module directory, how do they handle it?