rails/rails — comment on commit 06a3a8a458e70c1b6531ac53c57a302b162fd736
File:  line 0
By stevenh512:

@allix I disagree, the current behavior is unreasonable and unacceptable since every application is insecure by default. The fact that Github could fall victim to a mass assignment vulnerability should be more than enough evidence that this change is necessary. In fact, I'd go even further and say that config.active_record.whitelist_attributes should be set to true by default (not just in the generated application.rb) and developers who don't want it should have to specifically disable it. Any documentation or app that is "broken" by that change was already broken anyway, the developers just didn't realize it, so this change would wake them up and make their apps more secure in the long run.