rails XML vulnerability patched