Cherry pick security fix to 2 6 stable

Same as https://github.com/Shopify/liquid/pull/299, but for 2-6-stable

@arthurnn