2017/10/GHSA-mgx3-27hr-mfgp HTTParty does not restrict casts of string values