ActiveRecord Vulnerability - Circumvention of attr_protected
This one seems pretty amateur and should have been caught as part of a pull request/code review process.<p><pre><code>   - @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/
   + @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/
</code></pre>
^ and $ only match the first line in ruby, whereas \A and \z match across all lines.