aikido-zen 1.0.6-x86_64-darwin → 1.0.8-x86_64-darwin

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 165b83a0e7676d361b152becf0a158970360b0ca67df6954ef48f6b026d63c39
-  data.tar.gz: 0b8c71d3b57ffc78b51ccc2a2d272d161daa3ec67ffe0d88fddbbe37b7b7f431
+  metadata.gz: dbc29a2e5c3b22abf38a97b7e49e4db0b6ead2aa071b3762d944fd82413a2a82
+  data.tar.gz: 9d115aa2a78a2d9a922b00ac759d2dfc0cfa9880b0a47374cad4f5639fc8737c
 SHA512:
-  metadata.gz: 58cf73113a883a21a0efa418f76cdd1c42a111dba68c594a8baaf0f89fafb154142174f98839718dd067ef795ab7b62c503dc275bf6e41038c2b9a28960b22d9
-  data.tar.gz: 124e175c3bf52e164a8a7c3daede6211b7cd5d645cfa99f859bd4703fb60accf33cb9bcba7816cbd73c2eb5cb7129b652f06af0e6b0d98c78374bc8112cb84dc
+  metadata.gz: 553f0d1344d7bf3f4cd7cd738c2dd80486a3bc56f9182d93679fa7f558b9f33d5326e11e56db92f80d98fd2e4cd19de22298f5e752a5a1d9a9d1dd65a1510d34
+  data.tar.gz: 1ddf2449fbc52f91fa13fee3a62a118773a8c801b3d2055be03bfa7cece3c2cf5b5061f91fe519cc9fafd9ca12019448c6a903d3383be9531aac23ad57f0ba61

data/lib/aikido/zen/attack.rb

@@ -203,7 +203,9 @@ module Aikido::Zen
       end
 
       def input
-        Aikido::Zen::Payload::UNKNOWN_PAYLOAD
+        # When the payload is unknown the payload, source, and path properties
+        # should be undefined, not "unknown".
+        {}
       end
 
       def metadata

data/lib/aikido/zen/scanners/stored_ssrf_scanner.rb

@@ -38,11 +38,19 @@ module Aikido::Zen
 
         return if @config.imds_allowed_hosts.include?(@hostname)
 
-        @addresses.find do |candidate|
-          DANGEROUS_ADDRESSES.any? { |address| address === candidate }
+        @addresses.find do |address|
+          DANGEROUS_ADDRESSES.any? do |dangerous_address|
+            # Addresses are not considered stored IMDS addresses if the address
+            # is the same as the hostname. (These are valid IMDS requests, not spoofed ones)
+            next if address == @hostname
+
+            # True if the dangerous address is address or includes the address.
+            dangerous_address === address
+          end
         end
       end
 
+      # A dangerous address may be an individual address or an address range.
       DANGEROUS_ADDRESSES = [
         IPAddr.new("169.254.169.254"),
         IPAddr.new("100.100.100.200"),

data/lib/aikido/zen/sinks/action_controller.rb

@@ -20,6 +20,11 @@ module Aikido::Zen
         end
 
         def block?(controller)
+          # The abstract controller running the callback is typically an ActionController
+          # but it may also be an ActionMailer. ActionMailer does not respond to request.
+          # This feature requires a request object to perform checks and enforce blocking.
+          return false unless controller.respond_to?(:request)
+
           context = controller.request.env[Aikido::Zen::ENV_KEY]
           request = context.request
 

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.0.6"
+    VERSION = "1.0.8"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.48"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.0.6
+  version: 1.0.8
 platform: x86_64-darwin
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-12-29 00:00:00.000000000 Z
+date: 2026-01-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby