rails/rails — comment on commit b83965785db1eec019edf1fc272b1aa393e6dc57
File:  line 0
By jacortinas:

This is not something that's really "patchable", it's an issue with misinformation. If we all went with the most restrictive settings for mass assignment, then the issue would go away. The problem is that, it's not set to the most strict by default, nor is it as strongly urged (in documentation for example) as it could be. With so many new programmers and novices using Rails, it makes sense to be a little bit more novice-proof and security conscious by default, and make the model generators and default model require you to whitelist accessible attributes.