backport cve-2014-0130 fix

@square/railsfork-contributors