The rails team already does this. Here's an example patch for one change:

https://groups.google.com/forum/#!msg/ruby-security-ann/o0Ds...

Unfortunately that wouldn't have avoided this issue, as the problem was actually with the small security patch.