developers can easily bypass mass assignment protection without noticing

[OrlandoLee]

tainted information will not be passed when params[:user].symbolize_keys or params.to_hash (any method that may change the type) is called, because only ActionController::Parameters has permitted? method. So developers can easily accidentally bypass this strong parameter protection. Did strong parameter consider this?

[thomasfedb]

Hey @OrlandoLee. This is a compatibility gem for Rails versions prior to 4. Perhaps you should submit an issue against rails/rails to see if they consider this to be a security issue.