GitLab: SafeParamsHelper::safe_params is not so safe

Summary GitLab uses SafeParamsHelper to filter out some keys before passing them to urlfor: ruby def safeparams if params.respondto?:permit! params.except:host, :port, :protocol.permit! else params end end The issue is that there are a lot more dangerous keys: ruby RESERVEDOPTIONS = :host,...