Cheers,
There is a major security problem in ActiveRecord. I'm the process of writing the tests and the fix.
This should definitely go into 2.1 and be backported to 2.0.
I'm not sure I should post the exact problem here. Could somebody from the core team contact me?
Jonathan