Bug 908546 - Disallow injected cart values

No merge yet.