Results of running 'bundle update rails'
Upgrade to Rails 3.2.20 - fixes CVE-2014-7818

Arbitrary file existence disclosure in Action Pack
Comment out spec which sends an invalid utf-8 param.

The original error `ActionView::Template::Error` that this spec was
written to represent (#1406) occurred under ruby 1.8 when the decoded
non-utf-8 string was used in the locale switcher on the 'not found'
error page to generate a url for the alternative locales.

Under Ruby >= 1.9, the error thrown in that situation is an `invalid
byte sequence in UTF-8` error, thrown in the same place - the locale
switcher. However, no error seems to be thrown when the same param is
used in a request in production.

The upgrade to Rails 3.2.20 causes `String.split` to be called on the
request path in `actionpack/lib/action_dispatch/middleware/static.rb` in
order to check for attempts to access files outside the `public`
directory. This means that under Ruby >= 1.9, an `invalid byte sequence
in UTF-8` error will be thrown there in running this spec.

I think a possible solution is to use the `rack-utf8_sanitizer` gem to
provide middleware to strip invalid utf-8 from request URIs and headers
before they're processed by Rails, but it's currently unclear whether
that would have any undesirable side-effects.