aikido-zen 1.0.5-arm64-linux → 1.0.7-arm64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 42aa0c53c7c2db9edc33a04776dcf93773c7bf35eb3a0fd523a344b1cd208dc4
-  data.tar.gz: 380811891ab3396f024ccad2def27c32438a4b89ec9be80430c3d2a58519b446
+  metadata.gz: e47f76914e4629e5fd789d5a8d9c50839fc49f901d418098600690e13d2971e0
+  data.tar.gz: 51163c332eedde7ab23bb65a091b5171dc54c676508ce3955e267cadbf5bead6
 SHA512:
-  metadata.gz: 91d7e278c99c31c9bac45bf44bf491a22c890b32f03fff1bfda6cbdc7ab13c2c5bf803389db1c16d10371b286d3c94d542a60ba73a3034a0a9448c97510a2269
-  data.tar.gz: 5eca54161486245ec81db830e971deaafd508b0de2da2266ce0f5d138f2c6fb9c03dc41bdf9507db7dddf0edfd4f35e06b66dea4dd342c296a80552ede81692f
+  metadata.gz: ec40b829bdc3a3ba40f37e1de2b4daa7342765cdc9a4497006f143411ee43a1656925e84e80095553436c77b36270caf18f009a2e98d67b1ad00b47532a8c09e
+  data.tar.gz: 43481deab3aaad1c9c5324b469ca76bdd74bc97c335d9f55fa1a7a4fdbdac06fca1f64aca9373d6161587cf60197f3a11036b1c5ab2d9552b67ee7e83f6bf4b4

data/docs/config.md

@@ -5,15 +5,6 @@ changing values on the `Aikido::Zen.config` object, which you can do from
 your app's startup file (like an initializer in Rails, or `config.ru` in
 other Rack-based apps).
 
-## Middleware insertion
-
-By default, the Zen middleware is inserted after `ActionDispatch::Executor`.
-You can change this by setting `Aikido::Zen.config.insert_middleware_after`
-to a Rack middleware class or index.
-
-When set to `nil`, the middleware is inserted before the first middleware in
-the then-current middleware stack.
-
 ## Disable Zen
 
 In order to fully turn off Zen and prevent it from intercepting any requests or
@@ -45,11 +36,23 @@ set it via `Aikido::Zen.config.token = <token>`.
 
 ## Hardened mode
 
-Zen hardens methods, restricting dangerous undocumented behavior to improve
-security and performance.
+Zen hardens certain methods by blocking dangerous, undocumented behavior.
+This helps improve security and performance.
+
+Hardened mode is enabled by default. To disable it, set `AIKIDO_HARDEN=false`
+in your environment, or set `Aikido::Zen.config.harden = false`.
+
+When Zen detects dangerous undocumented behavior, it prevents the operation
+and raises an error, including a backtrace. For example, if code relies on
+undocumented behavior in `File.join`, Zen will raise a descriptive error:
+
+```
+TypeError: Zen prevented implicit conversion of Array to String in hardened method. Visit https://github.com/AikidoSec/firewall-ruby for more information.
+...
+```
 
-To disable method hardening, set `AIKIDO_HARDEN=false` in your environment,
-or set `Aikido::Zen.config.harden = false`.
+Only disable hardened mode if you are using code that relies on dangerous
+undocumented behavior and that code cannot be changed.
 
 ## Logger
 

data/lib/aikido/zen/sinks/action_controller.rb

@@ -20,6 +20,11 @@ module Aikido::Zen
         end
 
         def block?(controller)
+          # The abstract controller running the callback is typically an ActionController
+          # but it may also be an ActionMailer. ActionMailer does not respond to request.
+          # This feature requires a request object to perform checks and enforce blocking.
+          return false unless controller.respond_to?(:request)
+
           context = controller.request.env[Aikido::Zen::ENV_KEY]
           request = context.request
 

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.0.5"
+    VERSION = "1.0.7"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.48"

data/lib/aikido/zen/worker.rb

@@ -28,7 +28,8 @@ module Aikido::Zen
       executor.post do
         yield
       rescue Exception => err # rubocop:disable Lint/RescueException
-        @config.logger.error "Error in background worker: #{err.inspect}"
+        @config.logger.error("Error in background worker: #{err.class}: #{err.message}")
+        @config.logger.debug(err.backtrace.join("\n"))
       end
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.0.5
+  version: 1.0.7
 platform: arm64-linux
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-12-23 00:00:00.000000000 Z
+date: 2026-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby