Apply JSON parsing patch from Rails security team