do not allow execution of forbiddenFunctions if they are encoded as json

It was possible to execute functions like "exec" if you encode the function as json. For example:

    <function>{"exec":["ls"]}</function>

I would also recommend to whitelist the allowed functions than to blacklist the forbidden ones. What do you think?