aikido-zen 1.0.2.beta.1-x86_64-darwin → 1.0.2.beta.5-x86_64-darwin

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c55246b2bdb40b316fb80cf0aa1ddbedb6205c050a26b5b2f75e930d6a6cf989
-  data.tar.gz: 78156c513ccbadf7a7b3a8c24689d8629007bca189406fc1ea441c5c16763625
+  metadata.gz: 9ccfabb53e6358207908bf6989567f72189e2f64a330bf057d3cff2d1b766abf
+  data.tar.gz: b9ad9706eb476db63a0935ac51eeb0b123919a4b078ef41b8d295d1e12607dd6
 SHA512:
-  metadata.gz: 216f8686d16699dabfb416fb207f31e302b2239aa9393999f499af14237156818b5c5e45bb6fa7cbf3b214336e6059b96867a303932b9669b87460b20d0514f6
-  data.tar.gz: 470b07194b238bb4a44c283fce7ad7679ac8fa4df119feca684bb65bb7c75729157c9e77b38fbce8bcc9629780848455aa790af9159c12a349c1e71faa41ee02
+  metadata.gz: 7c9d5827a80d43f2fbfef0d23d87d55667b59ced61da74b1d7d94f68d1f064128254ff5819142e5f0e77854e5dc03222b1dc43db307e9d6635d0b51e0277d4a6
+  data.tar.gz: 7fd82ba385dbe8a579df66ea095c1d9f3e73ad264c57020c934efd092d3e86e9cb87cdeb21808d69e81d6ac3a3da7bce5df02fd64605d629741fceb697e74083

data/docs/proxy.md

@@ -0,0 +1,10 @@
+# Proxy settings
+
+We'll automatically use the `HTTP_X_FORWARDED_FOR` header to determine the client's IP address when behind a trusted proxy.
+
+If you need to use a different header to determine the client's IP address, you can set the `AIKIDO_CLIENT_IP_HEADER` environment variable to the name of that header. This will override the default `HTTP_X_FORWARDED_FOR` header.
+
+```bash
+# For Fly.io Platform
+AIKIDO_CLIENT_IP_HEADER=HTTP_FLY_CLIENT_IP bin/rails server
+```

data/docs/rails.md

@@ -66,7 +66,7 @@ Rails.application.config.zen.api_timeouts = 20
 You can access the configuration object both as `Aikido::Zen.config` or
 `Rails.configuration.zen`.
 
-See our [configuration guide](docs/config.md) for more details.
+See our [configuration guide](./config.md) for more details.
 
 ## Using Rails encrypted credentials
 

data/lib/aikido/zen/attack.rb

@@ -67,7 +67,9 @@ module Aikido::Zen
       end
 
       def metadata
-        {filename: filepath}
+        {
+          filename: filepath
+        }
       end
 
       def humanized_name
@@ -133,7 +135,10 @@ module Aikido::Zen
       end
 
       def metadata
-        {sql: @query}
+        {
+          sql: @query,
+          dialect: @dialect
+        }
       end
 
       def exception(*)
@@ -165,7 +170,7 @@ module Aikido::Zen
 
       def metadata
         {
-          host: @request.uri.hostname,
+          hostname: @request.uri.hostname,
           port: @request.uri.port
         }
       end
@@ -200,7 +205,10 @@ module Aikido::Zen
       end
 
       def metadata
-        {}
+        {
+          hostname: @hostname,
+          resolvedIP: @address
+        }
       end
     end
   end

data/lib/aikido/zen/config.rb

@@ -61,7 +61,7 @@ module Aikido::Zen
     # @return [Logger]
     attr_reader :logger
 
-    # @return [string] Path of the socket where the detached agent will listen.
+    # @return [String] Path of the socket where the detached agent will listen.
     # By default, is stored under the root application path with file name
     # `aikido-detached-agent.sock`
     attr_accessor :detached_agent_socket_path
@@ -70,6 +70,9 @@ module Aikido::Zen
     attr_accessor :debugging
     alias_method :debugging?, :debugging
 
+    # @return [String] environment specific HTTP header providing the client IP.
+    attr_accessor :client_ip_header
+
     # @return [Integer] maximum number of timing measurements to keep in memory
     #   before compressing them.
     attr_accessor :max_performance_samples
@@ -146,6 +149,12 @@ module Aikido::Zen
     #   the server returns a 429 response.
     attr_accessor :server_rate_limit_deadline
 
+    # @return [Boolean] whether Aikido Zen should scan for stored SSSRF attacks.
+    #   Defaults to true. Can be set through AIKIDO_FEATURE_STORED_SSRF
+    #   environment variable.
+    attr_accessor :stored_ssrf
+    alias_method :stored_ssrf?, :stored_ssrf
+
     # @return [Array<String>] when checking for stored SSRF attacks, we want to
     #   allow known hosts that should be able to resolve to the IMDS service.
     attr_accessor :imds_allowed_hosts
@@ -163,8 +172,9 @@ module Aikido::Zen
       self.json_decoder = DEFAULT_JSON_DECODER
       self.debugging = read_boolean_from_env(ENV.fetch("AIKIDO_DEBUG", false))
       self.logger = Logger.new($stdout, progname: "aikido", level: debugging ? Logger::DEBUG : Logger::INFO)
-      self.max_performance_samples = 5000
       self.detached_agent_socket_path = ENV.fetch("AIKIDO_DETACHED_AGENT_SOCKET_PATH", DEFAULT_DETACHED_AGENT_SOCKET_PATH)
+      self.client_ip_header = ENV.fetch("AIKIDO_CLIENT_IP_HEADER", nil)
+      self.max_performance_samples = 5000
       self.max_compressed_stats = 100
       self.max_outbound_connections = 200
       self.max_users_tracked = 1000
@@ -179,6 +189,7 @@ module Aikido::Zen
       self.api_schema_max_samples = Integer(ENV.fetch("AIKIDO_MAX_API_DISCOVERY_SAMPLES", 10))
       self.api_schema_collection_max_depth = 20
       self.api_schema_collection_max_properties = 20
+      self.stored_ssrf = read_boolean_from_env(ENV.fetch("AIKIDO_FEATURE_STORED_SSRF", true))
       self.imds_allowed_hosts = ["metadata.google.internal", "metadata.goog"]
     end
 

data/lib/aikido/zen/payload.rb

@@ -27,7 +27,7 @@ module Aikido::Zen
       {
         payload: value.to_s,
         source: SOURCE_SERIALIZATIONS[source],
-        pathToPayload: path.to_s
+        path: path.to_s
       }
     end
 

data/lib/aikido/zen/request.rb

@@ -17,8 +17,9 @@ module Aikido::Zen
     # @see Aikido::Zen.track_user
     attr_accessor :actor
 
-    def initialize(delegate, framework:, router:)
+    def initialize(delegate, config = Aikido::Zen.config, framework:, router:)
       super(delegate)
+      @config = config
       @framework = framework
       @router = router
       @body_read = false
@@ -40,6 +41,24 @@ module Aikido::Zen
       @schema ||= Aikido::Zen::Request::Schema.build
     end
 
+    # @api private
+    #
+    # @return [String] the IP address of the client making the request.
+    def client_ip
+      return @client_ip if @client_ip
+
+      if @config.client_ip_header
+        value = env[@config.client_ip_header]
+        if Resolv::AddressRegex.match?(value)
+          @client_ip = value
+        else
+          @config.logger.warn("Invalid IP address in custom client IP header `#{@config.client_ip_header}`: `#{value}`")
+        end
+      end
+
+      @client_ip ||= respond_to?(:remote_ip) ? remote_ip : ip
+    end
+
     # Map the CGI-style env Hash into "pretty-looking" headers, preserving the
     # values as-is. For example, HTTP_ACCEPT turns into "Accept", CONTENT_TYPE
     # turns into "Content-Type", and HTTP_X_FORWARDED_FOR turns into
@@ -87,7 +106,7 @@ module Aikido::Zen
       {
         method: request_method.downcase,
         url: url,
-        ipAddress: ip,
+        ipAddress: client_ip,
         userAgent: user_agent,
         headers: normalized_headers.reject { |_, val| val.to_s.empty? },
         body: truncated_body,

data/lib/aikido/zen/scanners/stored_ssrf_scanner.rb

@@ -33,7 +33,9 @@ module Aikido::Zen
       # @return [String, nil] either the offending address, or +nil+ if no
       #   address is deemed dangerous.
       def attack?
-        return false if @config.imds_allowed_hosts.include?(@hostname)
+        return unless @config.stored_ssrf? # Feature flag
+
+        return if @config.imds_allowed_hosts.include?(@hostname)
 
         @addresses.find do |candidate|
           DANGEROUS_ADDRESSES.any? { |address| address === candidate }

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.0.2.beta.1"
+    VERSION = "1.0.2.beta.5"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.39"

data/tasklib/libzen.rake

@@ -76,6 +76,7 @@ LIBZENS = [
   LibZen.new("arm64-darwin.dylib", "libzen_internals_aarch64-apple-darwin.dylib"),
   LibZen.new("arm64-linux.so", "libzen_internals_aarch64-unknown-linux-gnu.so"),
   LibZen.new("arm64-linux-musl.so", "libzen_internals_aarch64-unknown-linux-musl.so"),
+  LibZen.new("aarch64-linux.so", "libzen_internals_aarch64-unknown-linux-gnu.so"),
   LibZen.new("x86_64-darwin.dylib", "libzen_internals_x86_64-apple-darwin.dylib"),
   LibZen.new("x86_64-linux.so", "libzen_internals_x86_64-unknown-linux-gnu.so"),
   LibZen.new("x86_64-linux-musl.so", "libzen_internals_x86_64-unknown-linux-musl.so"),

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.0.2.beta.1
+  version: 1.0.2.beta.5
 platform: x86_64-darwin
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-08-27 00:00:00.000000000 Z
+date: 2025-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -74,6 +74,7 @@ files:
 - benchmarks/rails7.1_sql_injection.js
 - docs/banner.svg
 - docs/config.md
+- docs/proxy.md
 - docs/rails.md
 - lib/aikido-zen.rb
 - lib/aikido/zen.rb