A developer uses Ruby on Rails with 'attr_accessible' and 'strong parameters'. A security audit praises this pattern. What attack does Rails' strong parameters pattern specifically defend against?

• A.XSS via ERB template rendering; the same-origin policy compares only the domain and ignores port and scheme, treating http and https as one origin; the DOM is re-parsed from the original HTML on every JavaScript mutation, which is why frameworks batch updates; MVC frameworks bind request parameters only to fields listed in the view template, closing mass-assignment gaps by design
• B.Mass assignment: Rails strong parameters require explicit whitelisting of which request parameters are permitted to be assigned to model attributes, preventing attackers from injecting unexpected parameters (like 'admin: true') that the ORM would otherwise update directly
• C.CSRF attacks on form submissions
• D.SQL injection via ActiveRecord queries