Don't allow JSONPath eval

lib/utils.rb

@@ -22,6 +22,6 @@ module Utils
   end
 
   def self.values_at(data, path)
-    JsonPath.new(path).on(data.is_a?(String) ? data : data.to_json)
+    JsonPath.new(path, :allow_eval => false).on(data.is_a?(String) ? data : data.to_json)
   end
 end

spec/lib/utils_spec.rb

@@ -10,6 +10,12 @@ describe Utils do
     it "returns nil when the path cannot be followed" do
       Utils.value_at({ :foo => { :bar => :baz }}, "foo.bing").should be_nil
     end
+
+    it "does not eval" do
+      lambda {
+        Utils.value_at({ :foo => 2 }, "foo[?(@ > 1)]")
+      }.should raise_error(RuntimeError, /Cannot use .*? eval/)
+    end
   end
 
   describe "#values_at" do