Merge branch '2-3-later' into 2-3-stable

* 2-3-later:
  adding test for CVE

activerecord/test/cases/base_test.rb

@@ -920,6 +920,18 @@ def test_mass_assignment_protection_against_class_attribute_writers
     end
   end
 
+  def test_firm_safe_assign
+    firm = Company.new
+
+    assert_raise(ActiveRecord::UnknownAttributeError) do
+      firm.attributes = { "rating=\n" => 5 }
+    end
+    assert_equal 1, firm.rating
+
+    firm.attributes = { "rating(1)\n" => 5 }
+    assert_equal 1, firm.rating
+  end
+
   def test_customized_primary_key_remains_protected
     subscriber = Subscriber.new(:nick => 'webster123', :name => 'nice try')
     assert_nil subscriber.id