aikido-zen 1.9.0.beta.3-arm64-linux → 1.9.0.beta.4-arm64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d47c525917403194ad5eccc4498beaed1f636238707b6b0ab5e5b9fcd3e605f
-  data.tar.gz: e990ba5929f8a1eca2f2cb895bbdcab46eac0be4898dc0332cc85cb8c6239c46
+  metadata.gz: ada5e55768a0adb9c9311bf01868950a02636af957a14da9766e62a0e0fcb6a6
+  data.tar.gz: 8ace3f901aec31ba41afb86cac79dec53be98a60ec55226b65351aa417b73313
 SHA512:
-  metadata.gz: 217c17f0dd195b33401cb73971b74174dde3f1101bd1f07be46a19317e808d1b887e4bdb47088e80c53b97dd9c7795bd9fe8628bec2d87a022480e75af9a1cea
-  data.tar.gz: fcace5b55b5ffcbcb5b76c019addc01d730b7d301ba436afa31d85b61f19219592cb97d284907423f0a293848d2d3209559b63dd9e2855a9c2ccb66dfc602fba
+  metadata.gz: da321436b2e4cdb30c8fa6d3456c771bb9bb56f44afd9b5269a5f5cef1f6af8bdb59ab4dca7a05ce2336d46ac98b57aa407307514270cb7ec7f55707d2fd857c
+  data.tar.gz: 9ae53b66ccd877aae99d0fd59735c23e5e6bc9ffcc71231835eb52e0f4cfce4f51ebb594458df56dcbb9ec855646c46178e59f26040bd7a4a1d870056fc957cb

data/docs/rails.md

@@ -75,6 +75,20 @@ class ApplicationController < ActionController::Base
 end
 ```
 
+### Rate limiting groups
+
+To limit the number of requests for a group of users, you can use the
+`Aikido::Zen.set_rate_limit_group` method. For example, this is useful if you
+want to limit the number of requests per team or company.
+
+```ruby
+Aikido::Zen.set_rate_limit_group(current_user.team_id)
+```
+
+> [!NOTE]
+> If a rate limiting group is set, the configured rate limits are only applied
+> to the group and not to individual users or IP addresses.
+
 ## Configuration
 
 Zen exposes its configuration object to the Rails configuration, which you can

data/lib/aikido/zen/agent.rb

@@ -134,12 +134,19 @@ module Aikido::Zen
     def handle_attack(attack)
       attack.will_be_blocked! if Aikido::Zen.blocking_mode?
 
-      @config.logger.error(
-        format("Zen has %s a %s: %s", attack.blocked? ? "blocked" : "detected", attack.humanized_name, attack.as_json.to_json)
-      )
-      report(Events::Attack.new(attack: attack)) if @api_client.can_make_requests?
+      # Recording the attack must never prevent us from blocking it.
+      begin
+        @config.logger.error(
+          format("Zen has %s a %s: %s", attack.blocked? ? "blocked" : "detected", attack.humanized_name, attack.as_json.to_json)
+        )
+
+        report(Events::Attack.new(attack: attack)) if @api_client.can_make_requests?
+
+        @collector.track_attack(attack)
+      rescue => err
+        @config.logger.error("Zen failed to record an attack: #{err.class}: #{err.message}")
+      end
 
-      @collector.track_attack(attack)
       raise attack if attack.blocked?
     end
 

data/lib/aikido/zen/attack.rb

@@ -69,8 +69,10 @@ module Aikido::Zen
       end
 
       def metadata
+        safe_filepath = Aikido::Zen::Helpers.encode_safely(filepath)
+
         {
-          "filename" => filepath
+          "filename" => safe_filepath
         }
       end
 
@@ -106,8 +108,10 @@ module Aikido::Zen
       end
 
       def metadata
+        safe_command = Aikido::Zen::Helpers.encode_safely(@command)
+
         {
-          "command" => @command
+          "command" => safe_command
         }
       end
 
@@ -138,8 +142,10 @@ module Aikido::Zen
       end
 
       def metadata
+        safe_query = Aikido::Zen::Helpers.encode_safely(@query)
+
         {
-          "sql" => @query,
+          "sql" => safe_query,
           "dialect" => @dialect.name,
           "failedToTokenize" => @failed_to_tokenize || nil
         }.compact

data/lib/aikido/zen/config.rb

@@ -56,6 +56,10 @@ module Aikido::Zen
     #   each initial heartbeat event.
     attr_accessor :initial_heartbeat_delays
 
+    # @return [Integer] the maximum number of levels deep we want to traverse
+    #   when extracting payloads from a nested request property. Defaults to 64.
+    attr_accessor :extract_payloads_max_depth
+
     # @return [Symbol] the agent mode for forked worker processes. Can be set
     #   through the AIKIDO_AGENT_MODE environment variable.
     attr_reader :agent_mode
@@ -107,6 +111,10 @@ module Aikido::Zen
     #   the oldest seen users.
     attr_accessor :max_users_tracked
 
+    # @return [Integer] the maximum number of custom events tracked per request.
+    #   Defaults to 25.
+    attr_accessor :max_custom_events
+
     # @return [Proc{(Aikido::Zen::Request, Symbol, reason: String=nil) => Array(Integer, Hash, #each)}]
     #   Rack handler used to respond to requests from IPs, users or others blocked in the Aikido
     #   dashboard.
@@ -249,6 +257,7 @@ module Aikido::Zen
       self.api_timeouts = 10
       self.polling_interval = 60 # 1 min
       self.initial_heartbeat_delays = [30, 60 * 2] # 30 sec, 2 min
+      self.extract_payloads_max_depth = 64
       self.agent_mode = ENV.fetch("AIKIDO_AGENT_MODE", "shared")
       self.worker_process_polling_interval = 10
       self.worker_process_polling_jitter = 10
@@ -261,6 +270,7 @@ module Aikido::Zen
       self.max_compressed_stats = 100
       self.max_outbound_connections = 200
       self.max_users_tracked = 1000
+      self.max_custom_events = 25
       self.blocked_responder = DEFAULT_BLOCKED_RESPONDER
       self.rate_limited_responder = DEFAULT_RATE_LIMITED_RESPONDER
       self.rate_limiting_discriminator = DEFAULT_RATE_LIMITING_DISCRIMINATOR
@@ -442,7 +452,13 @@ module Aikido::Zen
 
     # @!visibility private
     DEFAULT_RATE_LIMITING_DISCRIMINATOR = ->(request) {
-      request.actor ? "actor:#{request.actor.id}" : request.client_ip
+      rate_limiting_group = request.rate_limiting_group
+      return "group:#{rate_limiting_group}" unless rate_limiting_group.nil?
+
+      actor = request.actor
+      return "actor:#{request.actor.id}" unless actor.nil?
+
+      request.client_ip
     }
   end
 end

data/lib/aikido/zen/context.rb

@@ -38,6 +38,9 @@ module Aikido::Zen
     attr_accessor :idor_protection_enabled
     alias_method :idor_protection_enabled?, :idor_protection_enabled
 
+    # @return [Integer]
+    attr_accessor :custom_events
+
     # @param request [Rack::Request] a Request object that implements the
     #   Rack::Request API, to which we will delegate behavior.
     # @param settings [Aikido::Zen::RuntimeSettings]
@@ -45,16 +48,20 @@ module Aikido::Zen
     # @yieldparam request [Rack::Request] the given request object.
     # @yieldreturn [Hash<Symbol, #flat_map>] map of payload source types
     #   to the actual data from the request to populate them.
-    def initialize(request, settings: Aikido::Zen.runtime_settings, &sources)
+    def initialize(request, zen: Aikido::Zen, config: zen.config, settings: zen.runtime_settings, &sources)
       @request = request
+      @config = config
       @settings = settings
       @payload_sources = sources
 
+      @max_depth = @config.extract_payloads_max_depth
+
       @metadata = {}
       @scanning = false
       @request_bypassed = nil
       @protection_disabled = false
       @idor_protection_enabled = false
+      @custom_events = 0
     end
 
     # Fetch some metadata stored in the Context.
@@ -102,31 +109,46 @@ module Aikido::Zen
     private
 
     # @!visibility private
-    def extract_payloads_from(data, source_type, prefix = nil)
+    def extract_payloads_from(data, source_type, prefix = nil, depth = 0)
+      return [] if depth > @max_depth
+
       if data.is_a?(String)
         [Payload.new(data, source_type, prefix.to_s)]
       elsif data.respond_to?(:to_hash)
         data.to_hash.flat_map do |key, value|
-          extract_payloads_from(value, source_type, [prefix, key].compact.join("."))
+          extract_payloads_from(value, source_type, [prefix, key].compact.join("."), depth + 1)
         end
       elsif data.respond_to?(:to_ary)
         array = data.to_ary
         return array if array.empty?
 
         payloads = array.flat_map.with_index do |value, index|
-          extract_payloads_from(value, source_type, [prefix, index].compact.join("."))
+          extract_payloads_from(value, source_type, [prefix, index].compact.join("."), depth + 1)
         end
 
         unless Aikido::Zen.config.harden?
           # Special case for File.join given a possibly nested array of strings,
           # as might occur when a query parameter is an array.
-          begin
-            string = File.join__internal_for_aikido_zen(*array)
-            if unsafe_path?(string)
-              payloads << Payload.new(string, source_type, [prefix, "__File.join__"].compact.join("."))
+
+          # File.join recursively joins nested string arrays, and can overflow
+          # the stack given deeply nested arrays.
+          #
+          # Flatten array to max depth and check that the flattened array is an
+          # array of strings before calling File.join__internal_for_aikido_zen,
+          # only if the array was fully flattened, to prevent a stack overflow.
+          #
+          # Checking that all values are Strings handily prevents a TypeError
+          # from being raised.
+          flattened_array = array.flatten(@max_depth)
+          if flattened_array.all? { |string| string.is_a?(String) }
+            begin
+              string = File.join__internal_for_aikido_zen(*flattened_array)
+              if unsafe_path?(string)
+                payloads << Payload.new(string, source_type, [prefix, "__File.join__"].compact.join("."))
+              end
+            rescue
+              # Could not create special payload for File.join.
             end
-          rescue
-            # Could not create special payload for File.join.
           end
         end
 

data/lib/aikido/zen/helpers.rb

@@ -29,6 +29,22 @@ module Aikido
 
         Regexp.new(regexp.source, regexp.options, timeout: timeout)
       end
+
+      # Returns a copy of the string safely encoded as UTF-8.
+      #
+      # Web servers may deliver request data as binary strings. These strings
+      # are relabeled as UTF-8 instead of being converted, because conversion
+      # would replace every non-ASCII byte with U+FFFD, even in valid UTF-8.
+      #
+      # @param string [String] the string
+      # @return [String] the valid UTF-8 string
+      def self.encode_safely(string)
+        if string.encoding == Encoding::BINARY
+          string.dup.force_encoding(Encoding::UTF_8).scrub
+        else
+          string.encode("UTF-8", invalid: :replace, undef: :replace)
+        end
+      end
     end
   end
 end

data/lib/aikido/zen/internals.rb

@@ -103,8 +103,8 @@ module Aikido::Zen
       # @raise [Aikido::Zen::InternalsError] if there's a problem loading or
       #   calling libzen.
       def self.detect_sql_injection(query, input, dialect)
-        query_bytes = encode_safely(query)
-        input_bytes = encode_safely(input)
+        query_bytes = Aikido::Zen::Helpers.encode_safely(query)
+        input_bytes = Aikido::Zen::Helpers.encode_safely(input)
 
         query_ptr = FFI::MemoryPointer.new(:uint8, query_bytes.bytesize)
         input_ptr = FFI::MemoryPointer.new(:uint8, input_bytes.bytesize)
@@ -123,7 +123,7 @@ module Aikido::Zen
       end
 
       def self.idor_analyze_sql(query, dialect)
-        query_bytes = encode_safely(query)
+        query_bytes = Aikido::Zen::Helpers.encode_safely(query)
         query_ptr = FFI::MemoryPointer.new(:uint8, query_bytes.bytesize)
         query_ptr.put_bytes(0, query_bytes)
 
@@ -134,13 +134,5 @@ module Aikido::Zen
         JSON.parse(result_json)
       end
     end
-
-    class << self
-      private
-
-      def encode_safely(string)
-        string.encode("UTF-8", invalid: :replace, undef: :replace)
-      end
-    end
   end
 end

data/lib/aikido/zen/payload.rb

@@ -24,10 +24,13 @@ module Aikido::Zen
     end
 
     def as_json
+      safe_value = Aikido::Zen::Helpers.encode_safely(value.to_s)
+      safe_path = Aikido::Zen::Helpers.encode_safely(path.to_s)
+
       {
-        "payload" => value.to_s,
+        "payload" => safe_value,
         "source" => SOURCE_SERIALIZATIONS[source],
-        "path" => ".#{path}"
+        "path" => ".#{safe_path}"
       }
     end
 

data/lib/aikido/zen/request.rb

@@ -17,6 +17,11 @@ module Aikido::Zen
     # @see Aikido::Zen.track_user
     attr_accessor :actor
 
+    # The current rate limiting group, if set by the host app.
+    #
+    # @return [String, nil]
+    attr_accessor :rate_limiting_group
+
     # The current tenant, if set by the host app.
     #
     # @return [Integer, String, nil]
@@ -86,13 +91,17 @@ module Aikido::Zen
     end
 
     def as_json
+      safe_url = Aikido::Zen::Helpers.encode_safely(url)
+      safe_user_agent = Aikido::Zen::Helpers.encode_safely(user_agent) if user_agent
+      safe_route_path = Aikido::Zen::Helpers.encode_safely(route.path) if route&.path
+
       {
         "method" => request_method.upcase,
-        "url" => url,
+        "url" => safe_url,
         "ipAddress" => client_ip,
-        "userAgent" => user_agent,
+        "userAgent" => safe_user_agent,
         "source" => framework,
-        "route" => route&.path
+        "route" => safe_route_path
       }
     end
 

data/lib/aikido/zen/scanners/path_traversal_scanner.rb

@@ -40,8 +40,8 @@ module Aikido::Zen
       end
 
       def initialize(filepath, input)
-        @filepath = filepath.downcase
-        @input = input.downcase
+        @filepath = Aikido::Zen::Helpers.encode_safely(filepath).downcase
+        @input = Aikido::Zen::Helpers.encode_safely(input).downcase
       end
 
       def attack?

data/lib/aikido/zen/scanners/shell_injection_scanner.rb

@@ -37,8 +37,8 @@ module Aikido::Zen
       # @param command [String]
       # @param input [String]
       def initialize(command, input)
-        @command = command
-        @input = input
+        @command = Aikido::Zen::Helpers.encode_safely(command)
+        @input = Aikido::Zen::Helpers.encode_safely(input)
       end
 
       def attack?

data/lib/aikido/zen/scanners/sql_injection_scanner.rb

@@ -53,8 +53,8 @@ module Aikido::Zen
       attr_reader :failed_to_tokenize
 
       def initialize(query, input, dialect)
-        @query = query.downcase
-        @input = input.downcase.strip
+        @query = Aikido::Zen::Helpers.encode_safely(query).downcase
+        @input = Aikido::Zen::Helpers.encode_safely(input).downcase.strip
         @dialect = dialect
       end
 

data/lib/aikido/zen/scanners/ssrf/private_ip_checker.rb

@@ -85,9 +85,11 @@ module Aikido::Zen
         # Matches strings that contain only characters that appear in some
         # form of IP address.
         #
+        # An IPv6 zone ID (e.g. "%eth0") may follow the address.
+        #
         # Hostnames are not expected to match, allowing `parse_address` to
         # skip the `Socket.getaddrinfo` call.
-        ADDRESS_REGEXP = /\A[0-9a-fx:.]+\z/i
+        ADDRESS_REGEXP = /\A[0-9a-fx:.]+(?:%[^%\s]+)?\z/i
 
         # Parses `address` as an IP address, in any form that is accepted
         # by `getaddrinfo`:
@@ -96,6 +98,7 @@ module Aikido::Zen
         # * Plain integer IPv4 notation, in decimal, octal, or hexadecimal
         #   (e.g. "2130706433", "017700000001", "0x7f000001")
         # * Shorthand dotted IPv4 notation (e.g. "127.1")
+        # * IPv6 notation with zone ID (e.g. "fe80::1%eth0")
         #
         # Delegates to `Socket.getaddrinfo` with the `AI_NUMERICHOST` flag,
         # which never performs a DNS lookup.
@@ -105,8 +108,10 @@ module Aikido::Zen
         def parse_address(address)
           return nil unless address.is_a?(String) && ADDRESS_REGEXP.match?(address)
 
-          Socket.getaddrinfo(address, nil, :UNSPEC, :STREAM, nil, Socket::AI_NUMERICHOST)
-            .map { |info| IPAddr.new(info[3]) }
+          Socket.getaddrinfo(address, nil, :UNSPEC, :STREAM, nil, Socket::AI_NUMERICHOST).map do |info|
+            # `IPAddr.new` only accepts a zone ID on Ruby 3.1+.
+            IPAddr.new(info[3].partition("%").first)
+          end
         rescue SocketError
           nil
         end

data/lib/aikido/zen/scanners/ssrf_scanner.rb

@@ -146,7 +146,9 @@ module Aikido::Zen
       #
       # @return [Array<URI>] a list of unique URIs based on the above criteria.
       def uris_from_input
-        input = @input.to_s
+        # Percent-encode input so URI() can parse it, as an app may do before
+        # making the request.
+        input = percent_encode(@input.to_s)
 
         # If you build a URI manually and set the hostname to an IPv6 string,
         # the URI library will be helpful to wrap it in brackets so it's a
@@ -167,6 +169,17 @@ module Aikido::Zen
         nil
       end
 
+      # Matches bytes not allowed in a URI (RFC 3986): any byte other than
+      # the unreserved and reserved characters, and any "%" that does not
+      # start a percent-encoded byte.
+      NOT_ALLOWED_IN_URI = /%(?![0-9A-Fa-f]{2})|[^A-Za-z0-9\-._~:\/?#\[\]@!$&'()*+,;=%]/n
+
+      # Percent-encodes characters not allowed in a URI, preserving existing
+      # percent-encoding.
+      def percent_encode(string)
+        string.b.gsub(NOT_ALLOWED_IN_URI) { |byte| format("%%%02X", byte.ord) }
+      end
+
       # Check if the input is an IPv6 that is not surrounded by square brackets.
       def unescaped_ipv6?(input)
         (

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.9.0.beta.3"
+    VERSION = "1.9.0.beta.4"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.74"

data/lib/aikido/zen/worker_process/agent/client.rb

@@ -64,7 +64,10 @@ module Aikido::Zen::WorkerProcess
       def calculate_rate_limits(request)
         result = @rpc_client.invoke(
           "calculate_rate_limits", Aikido::Zen::IPC::READ_TIMEOUT,
-          request.route.as_json, request.client_ip, request.actor&.as_json
+          request.route.as_json,
+          request.client_ip,
+          request.actor&.as_json,
+          request.rate_limiting_group
         )
 
         Aikido::Zen::RateLimiter::Result.from_json(result) if result

data/lib/aikido/zen/worker_process/agent/server.rb

@@ -22,8 +22,8 @@ module Aikido::Zen::WorkerProcess
           send_collector_events(events_data)
         end
 
-        @rpc_server.handle("calculate_rate_limits") do |respond, route_data, ip, actor_data|
-          result = calculate_rate_limits(route_data, ip, actor_data)
+        @rpc_server.handle("calculate_rate_limits") do |respond, route_data, ip, actor_data, rate_limiting_group|
+          result = calculate_rate_limits(route_data, ip, actor_data, rate_limiting_group)
           respond.call(result&.as_json)
         end
 
@@ -66,7 +66,7 @@ module Aikido::Zen::WorkerProcess
 
       # @api private
       # @note Visible for testing.
-      RequestKind = Struct.new(:route, :schema, :client_ip, :actor)
+      RequestKind = Struct.new(:route, :schema, :client_ip, :actor, :rate_limiting_group)
 
       def updated_settings(known_config_generation = nil, known_firewall_lists_generation = nil)
         result = {}
@@ -91,10 +91,10 @@ module Aikido::Zen::WorkerProcess
         end
       end
 
-      def calculate_rate_limits(route_data, ip, actor_data)
+      def calculate_rate_limits(route_data, ip, actor_data, rate_limiting_group)
         actor = Aikido::Zen::Actor.from_json(actor_data) if actor_data
         route = Aikido::Zen::Route.from_json(route_data)
-        Aikido::Zen.rate_limiter.calculate_rate_limits(RequestKind.new(route, nil, ip, actor))
+        Aikido::Zen.rate_limiter.calculate_rate_limits(RequestKind.new(route, nil, ip, actor, rate_limiting_group))
       end
 
       # @return [Array<Hash>, nil]

data/lib/aikido/zen.rb

@@ -278,6 +278,37 @@ module Aikido
       alias_method :set_user, :track_user
     end
 
+    # Set the rate limiting group.
+    #
+    # @param group [String, Integer] the rate limiting group id
+    # @return [void]
+    def self.set_rate_limiting_group(group)
+      return if config.disabled?
+
+      if group.nil? || group == ""
+        config.logger.warn("set_rate_limiting_group expects a non-empty group")
+        return
+      end
+
+      unless group.is_a?(String) || group.is_a?(Integer)
+        config.logger.warn("set_rate_limiting_group expects a String or Integer group, got #{group.class}")
+        return
+      end
+
+      context = current_context
+      if context.nil?
+        config.logger.warn("set_rate_limiting_group was called without a context")
+        return
+      end
+
+      context.request.rate_limiting_group = group.to_s
+    end
+
+    # Align with other Zen implementations, while keeping internal consistency.
+    class << self
+      alias_method :set_rate_limit_group, :set_rate_limiting_group
+    end
+
     # Track a custom event happening in your application, like a failed login or
     # a password reset request. Zen automatically attaches the IP address, user
     # agent, and current user (if you called .track_user) from the request.
@@ -300,6 +331,13 @@ module Aikido
 
       return if request_bypassed?
 
+      if context.custom_events >= config.max_custom_events
+        config.logger.warn("Dropped custom event #{name}: too many custom events were tracked for this request")
+        return
+      end
+
+      context.custom_events += 1
+
       event = Events::Custom.new(
         name: name,
         request: context.request,

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.9.0.beta.3
+  version: 1.9.0.beta.4
 platform: arm64-linux
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-01 00:00:00.000000000 Z
+date: 2026-10-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby