aikido-zen 1.0.4-x86_64-darwin → 1.0.6-x86_64-darwin

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e992f9e0ca0a0f3b20f0eb31106367e7b9a724e1fb78d7d3bd5ede8ba3574032
-  data.tar.gz: c44b8045d818b6757854469800c9e2e574cf04021278ca6fe7ee4c51a24ce93b
+  metadata.gz: 165b83a0e7676d361b152becf0a158970360b0ca67df6954ef48f6b026d63c39
+  data.tar.gz: 0b8c71d3b57ffc78b51ccc2a2d272d161daa3ec67ffe0d88fddbbe37b7b7f431
 SHA512:
-  metadata.gz: 2f48e09727dfbc9936061e6afd3622b4578b1cc2f47ea236e5a753c5aff638c1caafbdd177e338c5fdfaaff4adc249833a7a1078f780067c75d33626e0f81da6
-  data.tar.gz: 6f90817cd2bd1d3d7fd3abf507e4ed64f1abe08d53f3ccdfd7c342a7ec5ac8ae19af5038fc4e5cb6da0b9c3288968dcbf7bbda5599661fe2b6406dcd01c98664
+  metadata.gz: 58cf73113a883a21a0efa418f76cdd1c42a111dba68c594a8baaf0f89fafb154142174f98839718dd067ef795ab7b62c503dc275bf6e41038c2b9a28960b22d9
+  data.tar.gz: 124e175c3bf52e164a8a7c3daede6211b7cd5d645cfa99f859bd4703fb60accf33cb9bcba7816cbd73c2eb5cb7129b652f06af0e6b0d98c78374bc8112cb84dc

data/docs/config.md

@@ -36,11 +36,23 @@ set it via `Aikido::Zen.config.token = <token>`.
 
 ## Hardened mode
 
-Zen hardens methods, restricting dangerous undocumented behavior to improve
-security and performance.
+Zen hardens certain methods by blocking dangerous, undocumented behavior.
+This helps improve security and performance.
 
-To disable method hardening, set `AIKIDO_HARDEN=false` in your environment,
-or set `Aikido::Zen.config.harden = false`.
+Hardened mode is enabled by default. To disable it, set `AIKIDO_HARDEN=false`
+in your environment, or set `Aikido::Zen.config.harden = false`.
+
+When Zen detects dangerous undocumented behavior, it prevents the operation
+and raises an error, including a backtrace. For example, if code relies on
+undocumented behavior in `File.join`, Zen will raise a descriptive error:
+
+```
+TypeError: Zen prevented implicit conversion of Array to String in hardened method. Visit https://github.com/AikidoSec/firewall-ruby for more information.
+...
+```
+
+Only disable hardened mode if you are using code that relies on dangerous
+undocumented behavior and that code cannot be changed.
 
 ## Logger
 

data/lib/aikido/zen/config.rb

@@ -8,6 +8,12 @@ require_relative "context"
 
 module Aikido::Zen
   class Config
+    # @return [Class, Integer, nil] The Rack middleware class or index after which
+    #   the Zen middleware should be inserted. When set to nil, the middleware is
+    #   inserted before the first middleware in the then-current middleware stack.
+    #   Defaults to ::ActionDispatch::Executor.
+    attr_accessor :insert_middleware_after
+
     # @return [Boolean] whether Aikido should be turned completely off (no
     #   intercepting calls to protect the app, no agent process running, no
     #   middleware installed). Defaults to false (so, enabled). Can be set
@@ -178,6 +184,7 @@ module Aikido::Zen
     attr_accessor :attack_wave_max_cache_entries
 
     def initialize
+      self.insert_middleware_after = ::ActionDispatch::Executor
       self.disabled = read_boolean_from_env(ENV.fetch("AIKIDO_DISABLE", false)) || read_boolean_from_env(ENV.fetch("AIKIDO_DISABLED", false))
       self.blocking_mode = read_boolean_from_env(ENV.fetch("AIKIDO_BLOCK", false))
       self.api_timeouts = 10

data/lib/aikido/zen/rails_engine.rb

@@ -10,10 +10,10 @@ module Aikido::Zen
     end
 
     initializer "aikido.add_middleware", after: :load_config_initializers do |app|
-      # The midleware to be inserted in order. The first middleware is the existing
-      # middleware to use as an anchor point.
-      middleware = [
-        ::Rails::Rack::Logger,
+      # The Zen middleware is inserted in order as a block after the configured
+      # middleware anchor point.
+
+      middleware_block = [
         Aikido::Zen::Middleware::ForkDetector,
         Aikido::Zen::Middleware::ContextSetter,
         Aikido::Zen::Middleware::AllowedAddressChecker,
@@ -24,8 +24,16 @@ module Aikido::Zen
         Aikido::Zen::Middleware::RequestTracker
       ]
 
-      middleware.each_cons(2) do |existing_middleware, additional_middleware|
-        app.middleware.insert_after(existing_middleware, additional_middleware)
+      middleware_anchor = Aikido::Zen.config.insert_middleware_after
+
+      if middleware_anchor.nil?
+        app.middleware.insert_before 0, middleware_block.first
+      else
+        app.middleware.insert_after middleware_anchor, middleware_block.first
+      end
+
+      middleware_block.each_cons(2) do |existing_middleware, middleware|
+        app.middleware.insert_after(existing_middleware, middleware)
       end
 
       ActiveSupport.on_load(:action_controller) do

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.0.4"
+    VERSION = "1.0.6"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.48"

data/lib/aikido/zen/worker.rb

@@ -28,7 +28,8 @@ module Aikido::Zen
       executor.post do
         yield
       rescue Exception => err # rubocop:disable Lint/RescueException
-        @config.logger.error "Error in background worker: #{err.inspect}"
+        @config.logger.error("Error in background worker: #{err.class}: #{err.message}")
+        @config.logger.debug(err.backtrace.join("\n"))
       end
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.0.4
+  version: 1.0.6
 platform: x86_64-darwin
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-12-19 00:00:00.000000000 Z
+date: 2025-12-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby