Rails injection vulnerability patch