I'd like to suggest adding a whitelist of classes that we expect to be nested, instead of permitting a free-for-all.  e.g. in each controller that uses this, add a `nested_classes` method that returns either a map of string to class names, or list of strings to match params etc.