rails/rails — pull request #14016 by devlinzed (2014-02-11 15:50:39+00:00)
Title: Documentation: Don't symbolize tainted data.

[`I18n.locale=` symbolizes its argument](https://github.com/mattetti/i18n/blob/master/lib/i18n/config.rb#L11), so passing it `params[:locale]` allows one to DOS your application by visiting `...?locale=` URLS repeatedly, with unique values, until the never-GCed symbols monopolize the available memory.

This commit updates the example to include a basic whitelist, but doesn't describe its necessity.