There's also an 'Unsafe Query Risk', which is not a CVE and does not have a patch.[0]

I believe this script[1] should expose some of those dangerous columns. There's still the join alias risk, but I'm not sure, other than parsing a schema.rb, how to get at those effectively.

[0] https://groups.google.com/forum/#!topic/rubyonrails-security...

[1] https://gist.github.com/KevinMcHugh/fab941ec3677f9a19ee0