> but ruby doesn't track external strings as dirty like that.

It does:

  irb(main):001:0> gets.tainted?
  foo
  => true

You can even set $SAFE to 1 or higher to disallow the use of tainted strings in potentially dangerous commands:

  freya:~ flgr$ ruby -e '$SAFE = 1; system "tar bla bla #{gets}"'
  foo
  -e:1:in `system': Insecure operation: -r (SecurityError)
	  from -e:1:in `<main>'

See http://phrogz.net/programmingruby/taint.html for more information.