Let's get specific, because there's a point here that I think a lot of people are missing (including tptacek). ActionDispatch::Routing::RouteSet::NamedRouteCol

Let's get specific, because there's a point here that I think a lot of people are missing (including tptacek). ActionDispatch::Routing::RouteSet::NamedRouteCollection.add calls 'eval' on the property name passed to it. This invites exploitation. It also fails 'static_typed's desideratum of each component having a single responsibility. And I don't think calling it "magic" is too strong. I don't know to what extent the Ruby culture encourages calling 'eval' in random API routines like this, but when I previously argued here on HN that that had to be a bad idea, I got some pushback. I would certainly call this a dangerous anti-pattern. EDITED to add: reference: http://rubysource.com/anatomy-of-an-exploit-an-in-depth-look-at-the-rails-yaml-vulnerability/ http://rubysource.com/anatomy-of-an-exploit-an-in-depth-look...