rails/strong_parameters — pull request #185 by yyyc514 (2013-12-18 15:42:49+00:00)
Title: forbidden attributes leak thru the ActiveModel protection if in an array

Sample of the issue

```
class SomeController < ApplicationController

...
params[:street_addresses].each do |addr|
@contact.addresses.create addr
end
...
```

This code will succeed when it should fail (since params[:street_addresses] is not safe).