Fix read-string security hole globally rather than on per-instance basis