Ruby on Rails disclosed a bug submitted by amartinfraguas: https://hackerone.com/reports/1444151 [Source]