new sec vuln in rails and json patched