Multiple security issues in default install

[evax]

The problem was already reported and a tentative fix was proposed but:

• there is another occurrence of the the code it patches
• it uses double quotes so it doesn't protect much (you can still invoke arbitrary commands in subshells).
• the default install comes with the ruby.rb plugin which allows arbitrary code execution anway

[0xAX]

Thank you @evax for the report. [In progress]