aikido-zen 1.0.2 → 1.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a49ca0f5bf05158409f505e455616847e8cbf8b84987b928589559f666baaed8
-  data.tar.gz: 326a13bd0502d7b5215d6191eb2d060f2d1cdf805f02f62537327b98d92d44f2
+  metadata.gz: 9d138177952c1fa50bb1d06c44d913d4a5817cc6b574f2a0d081272871ad2d39
+  data.tar.gz: 536b5ad28b140bdd59294ed50bf0d37fabd77d77e099623a4c2c6b9f4592f7df
 SHA512:
-  metadata.gz: 7af1a11288994e4455f70f4d845a5b64d0c8d095ea299b9257dfa1a639f678dd340b2bc4794a9d8f740f0e210133e8b78b849fa3fe00140a4cbcc6c90737b02a
-  data.tar.gz: 5066f4e0bd2e2142703fdb3c9869c3a48d524f00d6354ca1d6eca1faa6110731c95751aeebb0f2103a47a01537dabcdfbf1ba63e30528e2a030ff76bb01e8c39
+  metadata.gz: 7455ec6799d1ce449ebc52c2f747d53b3baf6e3595141df760b159598c77b2894b54a8e6748f9cb19a0e30d1c75b466c924174e69474ee35efb7492d20967d2b
+  data.tar.gz: 221d50d4537a2f1008784b4edf05b5b7d847cf398f43c7e3ce4a71b30e44d96c1b2dd0423321c324c723ce80c8af61c929a8783cf01d8e05810c180056ccbb1f

data/lib/aikido/zen/context.rb

@@ -22,6 +22,13 @@ module Aikido::Zen
 
     # @return [Boolean]
     attr_accessor :scanning
+    alias_method :scanning?, :scanning
+
+    # @return [Boolean] whether attack protection for the currently requested
+    #   endpoint was disabled on the Aikido dashboard, or if the source IP for
+    #   this request is in the "Bypass List".
+    attr_accessor :protection_disabled
+    alias_method :protection_disabled?, :protection_disabled
 
     # @param request [Rack::Request] a Request object that implements the
     #   Rack::Request API, to which we will delegate behavior.
@@ -34,8 +41,10 @@ module Aikido::Zen
       @request = request
       @settings = settings
       @payload_sources = sources
+
       @metadata = {}
       @scanning = false
+      @protection_disabled = false
     end
 
     # Fetch some metadata stored in the Context.
@@ -75,16 +84,6 @@ module Aikido::Zen
       end
     end
 
-    # @return [Boolean] whether attack protection for the currently requested
-    #   endpoint was disabled on the Aikido dashboard, or if the source IP for
-    #   this request is in the "Bypass List".
-    def protection_disabled?
-      return false if request.nil?
-
-      !@settings.endpoints.match(request.route).all?(&:protected?) ||
-        @settings.allowed_ips.include?(request.ip)
-    end
-
     # @!visibility private
     def payload_sources
       @payload_sources.call(request)

data/lib/aikido/zen/middleware/attack_protector.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Aikido::Zen
+  module Middleware
+    class AttackProtector
+      def initialize(app, zen: Aikido::Zen, settings: zen.runtime_settings)
+        @app = app
+        @zen = zen
+        @settings = settings
+      end
+
+      def call(env)
+        context = @zen.current_context
+        request = context.request
+
+        context.protection_disabled = protection_disabled?(request)
+
+        @app.call(env)
+      end
+
+      private def protection_disabled?(request)
+        # Bypass attack protection for allowed IPs
+        return true if @settings.allowed_ips.include?(request.ip)
+
+        !@settings.endpoints.match(request.route).all?(&:protected?)
+      end
+    end
+  end
+end

data/lib/aikido/zen/rails_engine.rb

@@ -14,6 +14,7 @@ module Aikido::Zen
 
       app.middleware.use Aikido::Zen::Middleware::ContextSetter
       app.middleware.use Aikido::Zen::Middleware::AllowedAddressChecker
+      app.middleware.use Aikido::Zen::Middleware::AttackProtector
       app.middleware.use Aikido::Zen::Middleware::AttackWaveProtector
       # Request Tracker stats do not consider failed request or 40x, so the middleware
       # must be the last one wrapping the request.

data/lib/aikido/zen/sinks/pg.rb

@@ -42,9 +42,15 @@ module Aikido::Zen
           ::PG::Connection.class_eval do
             extend Sinks::DSL
 
-            %i[
-              send_query exec sync_exec async_exec
-              send_query_params exec_params sync_exec_params async_exec_params
+            [
+              :send_query,
+              :exec,
+              :sync_exec,
+              :async_exec,
+              :send_query_params,
+              :exec_params,
+              :sync_exec_params,
+              :async_exec_params
             ].each do |method_name|
               presafe_sink_before method_name do |query|
                 Helpers.safe do
@@ -53,8 +59,11 @@ module Aikido::Zen
               end
             end
 
-            %i[
-              send_prepare prepare async_prepare sync_prepare
+            [
+              :send_prepare,
+              :prepare,
+              :async_prepare,
+              :sync_prepare
             ].each do |method_name|
               presafe_sink_before method_name do |_, query|
                 Helpers.safe do

data/lib/aikido/zen/sinks.rb

@@ -28,6 +28,7 @@ require_relative "sinks/patron"
 require_relative "sinks/typhoeus" if defined?(::Typhoeus)
 require_relative "sinks/async_http"
 require_relative "sinks/em_http"
+
 require_relative "sinks/mysql2"
 require_relative "sinks/pg"
 require_relative "sinks/sqlite3"

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.0.2"
+    VERSION = "1.0.3"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.48"

data/lib/aikido/zen.rb

@@ -16,6 +16,7 @@ require_relative "zen/middleware/middleware"
 require_relative "zen/middleware/fork_detector"
 require_relative "zen/middleware/context_setter"
 require_relative "zen/middleware/allowed_address_checker"
+require_relative "zen/middleware/attack_protector"
 require_relative "zen/middleware/attack_wave_protector"
 require_relative "zen/middleware/request_tracker"
 require_relative "zen/outbound_connection"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.3
 platform: ruby
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-12-05 00:00:00.000000000 Z
+date: 2025-12-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -107,6 +107,7 @@ files:
 - lib/aikido/zen/helpers.rb
 - lib/aikido/zen/internals.rb
 - lib/aikido/zen/middleware/allowed_address_checker.rb
+- lib/aikido/zen/middleware/attack_protector.rb
 - lib/aikido/zen/middleware/attack_wave_protector.rb
 - lib/aikido/zen/middleware/context_setter.rb
 - lib/aikido/zen/middleware/fork_detector.rb