Fix #2248, convert ActiveSupport::SafeBuffer to string using #to_str

See #2248.

image_fu creates a ActiveSupport::SafeBuffer which is not escaped properly. Fixed it by converting it to a normal string using ActiveSupport::SafeBuffer#to_str