One solution is to add
SEPARATORS = %w( / ; , ? )
in your controller. I'm not sure if this still works under recent
versions of Rails.
Keep up to date with Rails on Twitter and This Week in Rails
Policies: Conduct, License, Maintenance, Security, Trademarks