Good question.  The thread on this was pretty long and convoluted, but my sense is that if the input is completely trusted load is fine.  In this case, it's a developer config for running specs and never referenced in operation, so I think it is fine.