Thanks @PragTob

and link_to with a block

[ci skip]

`render 'blah'` apparently noew renders the partial '_blah'

that looks like this:

module ActiveRecord
  class Base
    attr_accessible
  end
end

Also, could be wrong, but I think old check was broken?

but please don't ever use Brakeman::FindCall if it can
be avoided

[ci skip]

instead of using :only.
This is essentially a blacklist vs. whitelist issue.

upgrading is recommended, no workarounds
https://groups.google.com/group/rubyonrails-security/browse_thread/thread/edd28f1e3d04e913?pli=1

http://groups.google.com/group/rubyonrails-security/browse_thread/thread/9da0c515a6c4664

since most development is done with 1.9.3 now

fixes bug where resource routes attempted to merge into
:allow_all_actions

because before they were kind of all over the place

instead of "sexp? exp and exp.node_type == :blah"
or "sexp? exp and exp[0] == :blah"