rails/rails — pull request #6277 by homakov (2012-05-12 06:29:30+00:00)
Title: Comment for active_support's option in application.rb

A while ago whitelist_attributes was commented and people could un comment it.
escaping html in json is as well as mass assignment appears to be a security issue(XSS) and IMHO at least comment should presented in application.rb

related https://gist.github.com/2655020