0
@@ -262,13 +262,23 @@ module ActionController
0
           nil
0
         end
0
         
0
-        attr_accessor :controller_paths
0
-        
0
       protected
0
+        def safe_load_paths #:nodoc:
0
+          if defined?(RAILS_ROOT)
0
+            $LOAD_PATH.select do |base|
0
+              base = File.expand_path(base)
0
+              extended_root = File.expand_path(RAILS_ROOT)
0
+              # Exclude all paths that are not nested within app, lib, or components.
0
+              base.match(/\A#{Regexp.escape(extended_root)}\/*(app|lib|components)\/[a-z]/) || base =~ %r{rails-[\d.]+/builtin}
0
+            end
0
+          else
0
+            $LOAD_PATH
0
+          end
0
+        end
0
         
0
         def attempt_load(mod, const_name, path)
0
           has_dir = false
0
-          controller_paths.each do |load_path|
0
+          safe_load_paths.each do |load_path|
0
             full_path = File.join(load_path, path)
0
             file_path = full_path + '.rb'
0
             if File.file?(file_path) # Found a .rb file? Load it up

0
@@ -236,7 +236,6 @@ module Rails
0
     # loading module used to lazily load controllers (Configuration#controller_paths).
0
     def initialize_routing
0
       return unless configuration.frameworks.include?(:action_controller)
0
-      ActionController::Routing::ControllerComponent.controller_paths = configuration.controller_paths
0
       ActionController::Routing::Routes.reload
0
     end
0