Cherry pick security fix to 2-6-stable

Same as https://github.com/Shopify/liquid/pull/299, but for 2-6-stable

@arthurnn