Fix security issue with read-string/eval