1 files changed, 15 insertions, 6 deletions
diff --git a/actionpack/lib/action_dispatch/routing.rb b/actionpack/lib/action_dispatch/routing.rb
index 79d2f1f13c..61ebd0b8db 100644
--- a/actionpack/lib/action_dispatch/routing.rb
+++ b/actionpack/lib/action_dispatch/routing.rb
@@ -89,7 +89,7 @@ module ActionDispatch
   #
   # Example:
   #
-  #   # In routes.rb
+  #   # In config/routes.rb
   #   get '/login' => 'accounts#login', as: 'login'
   #
   #   # With render, redirect_to, tests, etc.
@@ -101,7 +101,7 @@ module ActionDispatch
   #
   # Use <tt>root</tt> as a shorthand to name a route for the root path "/".
   #
-  #   # In routes.rb
+  #   # In config/routes.rb
   #   root to: 'blogs#index'
   #
   #   # would recognize http://www.example.com/ as
@@ -114,15 +114,15 @@ module ActionDispatch
   # Note: when using +controller+, the route is simply named after the
   # method you call on the block parameter rather than map.
   #
-  #   # In routes.rb
+  #   # In config/routes.rb
   #   controller :blog do
   #     get 'blog/show'     => :list
   #     get 'blog/delete'   => :delete
-  #     get 'blog/edit/:id' => :edit
+  #     get 'blog/edit' => :edit
   #   end
   #
   #   # provides named routes for show, delete, and edit
-  #   link_to @article.title, show_path(id: @article.id)
+  #   link_to @article.title, blog_show_path(id: @article.id)
   #
   # == Pretty URLs
   #
@@ -196,7 +196,7 @@ module ActionDispatch
   #
   #   Rails.application.reload_routes!
   #
-  # This will clear all named routes and reload routes.rb if the file has been modified from
+  # This will clear all named routes and reload config/routes.rb if the file has been modified from
   # last load. To absolutely force reloading, use <tt>reload!</tt>.
   #
   # == Testing Routes
@@ -252,5 +252,14 @@ module ActionDispatch
 
     SEPARATORS = %w( / . ? ) #:nodoc:
     HTTP_METHODS = [:get, :head, :post, :patch, :put, :delete, :options] #:nodoc:
+
+    #:stopdoc:
+    INSECURE_URL_PARAMETERS_MESSAGE = <<-MSG.squish
+      Attempting to generate a URL from non-sanitized request parameters!
+
+      An attacker can inject malicious data into the generated URL, such as
+      changing the host. Whitelist and sanitize passed parameters to be secure.
+    MSG
+    #:startdoc:
   end
 end