gregbell/active_admin — pull request #1926 by Daxter (2013-02-16 01:27:55+00:00)
Title: Security Refactor (!!)

+ quite a bit of general refactoring
+ reverses params usage from blacklisting keys to explicitly whitelisting keys
+ adds in a monkey-patch to mitigate a similar vuln in Kaminari

In certain places we pass (almost) the __entire params hash__ to some other
method that calls `symbolize_keys` (often it's `url_for`). This means that an
attacker can DOS your website by passing arbitrary strings as parameters.
An example being: victim.com/somewhere?fuuuuuuuuuuuuuuuuuuuuuuuuuuuu

Symbols never leave memory (until app restart), so it's terribly effective against Ruby apps.

The good news is, only registered users are able to exploit this vulnerability.