> but ruby doesn't track external strings as dirty like that.

Yes, it does. E.g:

    x = STDIN.gets
    puts x.tainted?
    y = "hello "+x
    puts y.tainted?
    z = "foo"
    puts z.tainted?

The two first will return "true", and the last will print "false". If you set the safe-level appropriately some methods will be disallowed for x and y above (e.g. eval()), though I would not trust that as comprehensive, but it's a lot better than nothing.