* In mail_to :encode => :javascript, they weren't sanitizing email addresses, just catting them into the tag.
* There were using Enumerable#reject (ie, default allow) with a strict filter to decide which controllers/actions to route requests to, but case-insensitive filesystems aren't similarly strict.
* (Worst of all) ActiveRecord::QueryMethods#limit/limit_value wasn't sanitized while building queries (try Foo.limit("1,,0") for the flavor).
I don't know what the CSRF thing was either, but it looks like a headachey fix.
* There were using Enumerable#reject (ie, default allow) with a strict filter to decide which controllers/actions to route requests to, but case-insensitive filesystems aren't similarly strict.
* (Worst of all) ActiveRecord::QueryMethods#limit/limit_value wasn't sanitized while building queries (try Foo.limit("1,,0") for the flavor).
I don't know what the CSRF thing was either, but it looks like a headachey fix.