Requiring people to use StrongParameters in Rails 4 would be an acceptable resolution to this bug. But mutilating data that comes in to cover the persistence layer's weaknesses is ridiculous. I'm assuming this bug was an oversight.