backport rails/rails@0f3b7d1a319383f743
Fixes: CVE-2014-0130