From ec0664a6eb8906fcd31a53a1efad69bdc7fe6f5b Mon Sep 17 00:00:00 2001
From: devlin zed <me@devlinzed.com>
Date: Tue, 11 Feb 2014 10:44:45 -0500
Subject: Don't symbolize tainted data.

`I18n.locale=` symbolizes its argument, so passing it `params[:locale]`
allows one to DOS your application by visiting `...?locale=` URLS
repeatedly, with unique values, until the never-GCed symbols monopolize
the available memory.
---
 guides/source/i18n.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/guides/source/i18n.md b/guides/source/i18n.md
index d72717fa3b..088080721e 100644
--- a/guides/source/i18n.md
+++ b/guides/source/i18n.md
@@ -145,7 +145,11 @@ The _setting part_ is easy. You can set the locale in a `before_action` in the `
 before_action :set_locale
 
 def set_locale
-  I18n.locale = params[:locale] || I18n.default_locale
+  if %w[en fr].include?(params[:locale])
+    I18n.locale = params[:locale]
+  else
+    I18n.locale = I18n.default_locale
+  end
 end
 ```
 
-- 
cgit v1.2.3