Harden plist parsing

Library/Homebrew/formula_cellar_checks.rb

@@ -232,7 +232,7 @@ module FormulaCellarChecks
     return unless prefix.directory?
 
     plist = begin
-      Plist.parse_xml(plist)
+      Plist.parse_xml(plist, marshal: false)
     rescue
       nil
     end

Library/Homebrew/system_command.rb

@@ -357,7 +357,7 @@ class SystemCommand
           Regexp.last_match(1)
         end
 
-        Plist.parse_xml(output)
+        Plist.parse_xml(output, marshal: false)
       end
     end