rails/rails — comment on commit 06a3a8a458e70c1b6531ac53c57a302b162fd736
File:  line 0
By andyvb:

+1 on the fix, but the reason mass assignment exists in the first place is for convenience and DRYness of syntax. Sometimes it's still convenient to use update_attributes outside of a controller for 'unsafe' attributes and with a default whitelist you can't. What about something that mirrors #html_safe?:

```
foo.update_attributes({:a => 'bar'}.attr_safe)
```