rails/rails — comment on commit 2b74968f03fa4fbdf8afaa497b8446cb00fbddcd
File:  line 0
By dhruvbird:

@jgaskins I was referring to the flaw (or informed oversight as some might want to call it) in rails itself - comment not directed at github, who happened to be a victim in the whole thing. The point of the person who did this was to ensure that the defaults are "secure" and not amenable to be made secure with some tweaking.

I understand though that the bug isn't entirely fixed.