aikido-zen 1.0.4-arm64-darwin → 1.0.6-arm64-darwin

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d199584d84b238845c7c86ac4cfe4dca848689b1362b7aed0d20bada8c4df7a
-  data.tar.gz: 05736ee0f693be319ce8f33e0f02f86be78c42901ca3ec32e57ed975945288a8
+  metadata.gz: e3e03230ab919b0c315ed8b29da4b84986c25f6e3372f79fe1dfabaf424d47a9
+  data.tar.gz: ad61191fd8df71828d42606e37a8817537f2ff0cf16d8d6769c63051b5c95632
 SHA512:
-  metadata.gz: b533c37040e50c820047e020d1eccb75448520aa6b9e891a3f59a418a3b1f9a9be3679b78211f70ead9d3d592e10883c82b3313f6886f28136fb11e82ec4e8c3
-  data.tar.gz: da3b9afb9301302644ca56bc1db6dd54e7f8299c093252ba6d5c09a9ef42b25962da34f45ad270904a923001dace6f78c63259fde872f2d388ae8bf4b060a126
+  metadata.gz: f9bb223cefd764a5c1ffde53e85bddb24167c25c6674f3fb06969c234ad9d31b2b49532e07f2e9f852760bafefc95c07edd5d6d8e4bae2484bc8b799903acd37
+  data.tar.gz: e61d4fe5f5b433d8e7964ab52bc9739ef18a283f907da10755c3aa78a1a005dfc7d15c30c54358b88ae2a10b3a8d0309b028e02c8732dd37971127ee5b289acd

data/docs/config.md

@@ -36,11 +36,23 @@ set it via `Aikido::Zen.config.token = <token>`.
 
 ## Hardened mode
 
-Zen hardens methods, restricting dangerous undocumented behavior to improve
-security and performance.
+Zen hardens certain methods by blocking dangerous, undocumented behavior.
+This helps improve security and performance.
 
-To disable method hardening, set `AIKIDO_HARDEN=false` in your environment,
-or set `Aikido::Zen.config.harden = false`.
+Hardened mode is enabled by default. To disable it, set `AIKIDO_HARDEN=false`
+in your environment, or set `Aikido::Zen.config.harden = false`.
+
+When Zen detects dangerous undocumented behavior, it prevents the operation
+and raises an error, including a backtrace. For example, if code relies on
+undocumented behavior in `File.join`, Zen will raise a descriptive error:
+
+```
+TypeError: Zen prevented implicit conversion of Array to String in hardened method. Visit https://github.com/AikidoSec/firewall-ruby for more information.
+...
+```
+
+Only disable hardened mode if you are using code that relies on dangerous
+undocumented behavior and that code cannot be changed.
 
 ## Logger
 

data/lib/aikido/zen/config.rb

@@ -8,6 +8,12 @@ require_relative "context"
 
 module Aikido::Zen
   class Config
+    # @return [Class, Integer, nil] The Rack middleware class or index after which
+    #   the Zen middleware should be inserted. When set to nil, the middleware is
+    #   inserted before the first middleware in the then-current middleware stack.
+    #   Defaults to ::ActionDispatch::Executor.
+    attr_accessor :insert_middleware_after
+
     # @return [Boolean] whether Aikido should be turned completely off (no
     #   intercepting calls to protect the app, no agent process running, no
     #   middleware installed). Defaults to false (so, enabled). Can be set
@@ -178,6 +184,7 @@ module Aikido::Zen
     attr_accessor :attack_wave_max_cache_entries
 
     def initialize
+      self.insert_middleware_after = ::ActionDispatch::Executor
       self.disabled = read_boolean_from_env(ENV.fetch("AIKIDO_DISABLE", false)) || read_boolean_from_env(ENV.fetch("AIKIDO_DISABLED", false))
       self.blocking_mode = read_boolean_from_env(ENV.fetch("AIKIDO_BLOCK", false))
       self.api_timeouts = 10

data/lib/aikido/zen/rails_engine.rb

@@ -10,10 +10,10 @@ module Aikido::Zen
     end
 
     initializer "aikido.add_middleware", after: :load_config_initializers do |app|
-      # The midleware to be inserted in order. The first middleware is the existing
-      # middleware to use as an anchor point.
-      middleware = [
-        ::Rails::Rack::Logger,
+      # The Zen middleware is inserted in order as a block after the configured
+      # middleware anchor point.
+
+      middleware_block = [
         Aikido::Zen::Middleware::ForkDetector,
         Aikido::Zen::Middleware::ContextSetter,
         Aikido::Zen::Middleware::AllowedAddressChecker,
@@ -24,8 +24,16 @@ module Aikido::Zen
         Aikido::Zen::Middleware::RequestTracker
       ]
 
-      middleware.each_cons(2) do |existing_middleware, additional_middleware|
-        app.middleware.insert_after(existing_middleware, additional_middleware)
+      middleware_anchor = Aikido::Zen.config.insert_middleware_after
+
+      if middleware_anchor.nil?
+        app.middleware.insert_before 0, middleware_block.first
+      else
+        app.middleware.insert_after middleware_anchor, middleware_block.first
+      end
+
+      middleware_block.each_cons(2) do |existing_middleware, middleware|
+        app.middleware.insert_after(existing_middleware, middleware)
       end
 
       ActiveSupport.on_load(:action_controller) do

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.0.4"
+    VERSION = "1.0.6"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.48"

data/lib/aikido/zen/worker.rb

@@ -28,7 +28,8 @@ module Aikido::Zen
       executor.post do
         yield
       rescue Exception => err # rubocop:disable Lint/RescueException
-        @config.logger.error "Error in background worker: #{err.inspect}"
+        @config.logger.error("Error in background worker: #{err.class}: #{err.message}")
+        @config.logger.debug(err.backtrace.join("\n"))
       end
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.0.4
+  version: 1.0.6
 platform: arm64-darwin
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-12-19 00:00:00.000000000 Z
+date: 2025-12-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby