[Bug 539976] command injection in preload