aikido-zen 1.0.2.beta.1-x86_64-mingw-64 → 1.0.2.beta.5-x86_64-mingw-64

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 87a850ae8220f054a061b224178e250c7f8e8c734f8c3a4451a62f7ebf464377
-  data.tar.gz: c3801386633cec931748c69ba7f66ad219e21329c59ce7486585cc324a8b7125
+  metadata.gz: 4052b91cc3b58179ae6d97ba79f9fa8577ebf0302b79371029194a04bf63b0a2
+  data.tar.gz: 70dcefe99d1eacf6fc855b4cb4e0d9a9d437d6c2939fa16f33c3d9ec5685c78b
 SHA512:
-  metadata.gz: ff8359526cba8c500244203a3d979592813140a2685c58f81702dd89fa80faed85d43f6e76f765db1aad48b27733fc4f79cfdd51bfb97f79b5dffd7e060b1888
-  data.tar.gz: e707a8623f2081c11031e47e1b22ba35d503ca29dfee2ea234e3379d1cbac194cc6147de5bc30a99f5534f0cfa170aea4ab9038510826c09ed3a36e7aab7415e
+  metadata.gz: 50f28c46252e78156401160ac9b5b10c5be975b85511c4ff5956a3d0c9338839625ea2efcd187b6164fb330db686a155489ef7947038f18ac22f484a3311efc5
+  data.tar.gz: fd81224aed695c7e30230967a6ccf72a51581ff731d876bb9db7a6f54498a162315d821df5b7bb77fc2f802cd6326d306a98fb29bc286d63f5cf61e72d4b2ef6

data/docs/proxy.md

@@ -0,0 +1,10 @@
+# Proxy settings
+
+We'll automatically use the `HTTP_X_FORWARDED_FOR` header to determine the client's IP address when behind a trusted proxy.
+
+If you need to use a different header to determine the client's IP address, you can set the `AIKIDO_CLIENT_IP_HEADER` environment variable to the name of that header. This will override the default `HTTP_X_FORWARDED_FOR` header.
+
+```bash
+# For Fly.io Platform
+AIKIDO_CLIENT_IP_HEADER=HTTP_FLY_CLIENT_IP bin/rails server
+```

data/docs/rails.md

@@ -66,7 +66,7 @@ Rails.application.config.zen.api_timeouts = 20
 You can access the configuration object both as `Aikido::Zen.config` or
 `Rails.configuration.zen`.
 
-See our [configuration guide](docs/config.md) for more details.
+See our [configuration guide](./config.md) for more details.
 
 ## Using Rails encrypted credentials
 

data/lib/aikido/zen/attack.rb

@@ -67,7 +67,9 @@ module Aikido::Zen
       end
 
       def metadata
-        {filename: filepath}
+        {
+          filename: filepath
+        }
       end
 
       def humanized_name
@@ -133,7 +135,10 @@ module Aikido::Zen
       end
 
       def metadata
-        {sql: @query}
+        {
+          sql: @query,
+          dialect: @dialect
+        }
       end
 
       def exception(*)
@@ -165,7 +170,7 @@ module Aikido::Zen
 
       def metadata
         {
-          host: @request.uri.hostname,
+          hostname: @request.uri.hostname,
           port: @request.uri.port
         }
       end
@@ -200,7 +205,10 @@ module Aikido::Zen
       end
 
       def metadata
-        {}
+        {
+          hostname: @hostname,
+          resolvedIP: @address
+        }
       end
     end
   end

data/lib/aikido/zen/config.rb

@@ -61,7 +61,7 @@ module Aikido::Zen
     # @return [Logger]
     attr_reader :logger
 
-    # @return [string] Path of the socket where the detached agent will listen.
+    # @return [String] Path of the socket where the detached agent will listen.
     # By default, is stored under the root application path with file name
     # `aikido-detached-agent.sock`
     attr_accessor :detached_agent_socket_path
@@ -70,6 +70,9 @@ module Aikido::Zen
     attr_accessor :debugging
     alias_method :debugging?, :debugging
 
+    # @return [String] environment specific HTTP header providing the client IP.
+    attr_accessor :client_ip_header
+
     # @return [Integer] maximum number of timing measurements to keep in memory
     #   before compressing them.
     attr_accessor :max_performance_samples
@@ -146,6 +149,12 @@ module Aikido::Zen
     #   the server returns a 429 response.
     attr_accessor :server_rate_limit_deadline
 
+    # @return [Boolean] whether Aikido Zen should scan for stored SSSRF attacks.
+    #   Defaults to true. Can be set through AIKIDO_FEATURE_STORED_SSRF
+    #   environment variable.
+    attr_accessor :stored_ssrf
+    alias_method :stored_ssrf?, :stored_ssrf
+
     # @return [Array<String>] when checking for stored SSRF attacks, we want to
     #   allow known hosts that should be able to resolve to the IMDS service.
     attr_accessor :imds_allowed_hosts
@@ -163,8 +172,9 @@ module Aikido::Zen
       self.json_decoder = DEFAULT_JSON_DECODER
       self.debugging = read_boolean_from_env(ENV.fetch("AIKIDO_DEBUG", false))
       self.logger = Logger.new($stdout, progname: "aikido", level: debugging ? Logger::DEBUG : Logger::INFO)
-      self.max_performance_samples = 5000
       self.detached_agent_socket_path = ENV.fetch("AIKIDO_DETACHED_AGENT_SOCKET_PATH", DEFAULT_DETACHED_AGENT_SOCKET_PATH)
+      self.client_ip_header = ENV.fetch("AIKIDO_CLIENT_IP_HEADER", nil)
+      self.max_performance_samples = 5000
       self.max_compressed_stats = 100
       self.max_outbound_connections = 200
       self.max_users_tracked = 1000
@@ -179,6 +189,7 @@ module Aikido::Zen
       self.api_schema_max_samples = Integer(ENV.fetch("AIKIDO_MAX_API_DISCOVERY_SAMPLES", 10))
       self.api_schema_collection_max_depth = 20
       self.api_schema_collection_max_properties = 20
+      self.stored_ssrf = read_boolean_from_env(ENV.fetch("AIKIDO_FEATURE_STORED_SSRF", true))
       self.imds_allowed_hosts = ["metadata.google.internal", "metadata.goog"]
     end
 

data/lib/aikido/zen/payload.rb

@@ -27,7 +27,7 @@ module Aikido::Zen
       {
         payload: value.to_s,
         source: SOURCE_SERIALIZATIONS[source],
-        pathToPayload: path.to_s
+        path: path.to_s
       }
     end
 

data/lib/aikido/zen/request.rb

@@ -17,8 +17,9 @@ module Aikido::Zen
     # @see Aikido::Zen.track_user
     attr_accessor :actor
 
-    def initialize(delegate, framework:, router:)
+    def initialize(delegate, config = Aikido::Zen.config, framework:, router:)
       super(delegate)
+      @config = config
       @framework = framework
       @router = router
       @body_read = false
@@ -40,6 +41,24 @@ module Aikido::Zen
       @schema ||= Aikido::Zen::Request::Schema.build
     end
 
+    # @api private
+    #
+    # @return [String] the IP address of the client making the request.
+    def client_ip
+      return @client_ip if @client_ip
+
+      if @config.client_ip_header
+        value = env[@config.client_ip_header]
+        if Resolv::AddressRegex.match?(value)
+          @client_ip = value
+        else
+          @config.logger.warn("Invalid IP address in custom client IP header `#{@config.client_ip_header}`: `#{value}`")
+        end
+      end
+
+      @client_ip ||= respond_to?(:remote_ip) ? remote_ip : ip
+    end
+
     # Map the CGI-style env Hash into "pretty-looking" headers, preserving the
     # values as-is. For example, HTTP_ACCEPT turns into "Accept", CONTENT_TYPE
     # turns into "Content-Type", and HTTP_X_FORWARDED_FOR turns into
@@ -87,7 +106,7 @@ module Aikido::Zen
       {
         method: request_method.downcase,
         url: url,
-        ipAddress: ip,
+        ipAddress: client_ip,
         userAgent: user_agent,
         headers: normalized_headers.reject { |_, val| val.to_s.empty? },
         body: truncated_body,

data/lib/aikido/zen/scanners/stored_ssrf_scanner.rb

@@ -33,7 +33,9 @@ module Aikido::Zen
       # @return [String, nil] either the offending address, or +nil+ if no
       #   address is deemed dangerous.
       def attack?
-        return false if @config.imds_allowed_hosts.include?(@hostname)
+        return unless @config.stored_ssrf? # Feature flag
+
+        return if @config.imds_allowed_hosts.include?(@hostname)
 
         @addresses.find do |candidate|
           DANGEROUS_ADDRESSES.any? { |address| address === candidate }

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.0.2.beta.1"
+    VERSION = "1.0.2.beta.5"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.39"

data/tasklib/libzen.rake

@@ -76,6 +76,7 @@ LIBZENS = [
   LibZen.new("arm64-darwin.dylib", "libzen_internals_aarch64-apple-darwin.dylib"),
   LibZen.new("arm64-linux.so", "libzen_internals_aarch64-unknown-linux-gnu.so"),
   LibZen.new("arm64-linux-musl.so", "libzen_internals_aarch64-unknown-linux-musl.so"),
+  LibZen.new("aarch64-linux.so", "libzen_internals_aarch64-unknown-linux-gnu.so"),
   LibZen.new("x86_64-darwin.dylib", "libzen_internals_x86_64-apple-darwin.dylib"),
   LibZen.new("x86_64-linux.so", "libzen_internals_x86_64-unknown-linux-gnu.so"),
   LibZen.new("x86_64-linux-musl.so", "libzen_internals_x86_64-unknown-linux-musl.so"),

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.0.2.beta.1
+  version: 1.0.2.beta.5
 platform: x86_64-mingw-64
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-08-27 00:00:00.000000000 Z
+date: 2025-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -74,6 +74,7 @@ files:
 - benchmarks/rails7.1_sql_injection.js
 - docs/banner.svg
 - docs/config.md
+- docs/proxy.md
 - docs/rails.md
 - lib/aikido-zen.rb
 - lib/aikido/zen.rb