aikido-zen 1.9.0.beta.3-arm64-linux → 1.9.1-arm64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d47c525917403194ad5eccc4498beaed1f636238707b6b0ab5e5b9fcd3e605f
-  data.tar.gz: e990ba5929f8a1eca2f2cb895bbdcab46eac0be4898dc0332cc85cb8c6239c46
+  metadata.gz: df231e175ddfcbc1a8c21d8c0e23575d13de65a47214a0c191b9b94bdc7d7b51
+  data.tar.gz: 257407c5c9630af6ea66536e4ffc2ae9e8042b5eba98eb53f5baa61bf04d1ba8
 SHA512:
-  metadata.gz: 217c17f0dd195b33401cb73971b74174dde3f1101bd1f07be46a19317e808d1b887e4bdb47088e80c53b97dd9c7795bd9fe8628bec2d87a022480e75af9a1cea
-  data.tar.gz: fcace5b55b5ffcbcb5b76c019addc01d730b7d301ba436afa31d85b61f19219592cb97d284907423f0a293848d2d3209559b63dd9e2855a9c2ccb66dfc602fba
+  metadata.gz: d758d8a41ab1387576a0202135df2526f62aaa0d594104cce44812051e3941b24edcc7d06d86a9837d8542eab521c08f5d72513b687619c2609183f403a70b3f
+  data.tar.gz: 23997d7f758c63551deff8cefb2d067fa6c0816744f247f6ab15a89d7554aa6f9bfef0e8420a81ec4c66ad1043b7b6702990a6402cb64aed01063f0061478aae

data/docs/rails.md

@@ -75,6 +75,20 @@ class ApplicationController < ActionController::Base
 end
 ```
 
+### Rate limiting groups
+
+To limit the number of requests for a group of users, you can use the
+`Aikido::Zen.set_rate_limit_group` method. For example, this is useful if you
+want to limit the number of requests per team or company.
+
+```ruby
+Aikido::Zen.set_rate_limit_group(current_user.team_id)
+```
+
+> [!NOTE]
+> If a rate limiting group is set, the configured rate limits are only applied
+> to the group and not to individual users or IP addresses.
+
 ## Configuration
 
 Zen exposes its configuration object to the Rails configuration, which you can

data/lib/aikido/zen/agent.rb

@@ -134,12 +134,17 @@ module Aikido::Zen
     def handle_attack(attack)
       attack.will_be_blocked! if Aikido::Zen.blocking_mode?
 
-      @config.logger.error(
-        format("Zen has %s a %s: %s", attack.blocked? ? "blocked" : "detected", attack.humanized_name, attack.as_json.to_json)
-      )
-      report(Events::Attack.new(attack: attack)) if @api_client.can_make_requests?
+      # Recording the attack must never prevent us from blocking it.
+      begin
+        @config.logger.error(attack_log_message(attack))
+
+        report(Events::Attack.new(attack: attack)) if @api_client.can_make_requests?
+
+        @collector.track_attack(attack)
+      rescue => err
+        @config.logger.error("Zen failed to record an attack: #{err.class}: #{err.message}")
+      end
 
-      @collector.track_attack(attack)
       raise attack if attack.blocked?
     end
 
@@ -220,6 +225,21 @@ module Aikido::Zen
 
     private
 
+    def attack_log_message(attack)
+      input = attack.as_json
+
+      format(
+        "Zen has %s a %s: %s(...) originating from %s%s",
+        attack.blocked? ? "blocked" : "detected",
+        attack.humanized_name,
+        attack.operation,
+        input["source"],
+        # The path is built from names in the request, so it can't be trusted
+        # not to split the log line.
+        input["path"].to_s.gsub(/[\r\n]/, " ")
+      )
+    end
+
     def settings_updated(event)
       updated_at = Time.at(event[:data]["configUpdatedAt"].to_i)
 

data/lib/aikido/zen/api_client.rb

@@ -16,12 +16,6 @@ module Aikido::Zen
       @config = config
       @system_info = system_info
       @rate_limiter = rate_limiter
-
-      @should_fetch_settings_endpoint = @config.realtime_endpoint
-    end
-
-    def should_fetch_settings_endpoint=(uri)
-      @should_fetch_settings_endpoint = URI(uri)
     end
 
     # @return [Boolean] whether we have a configured token.
@@ -44,16 +38,16 @@ module Aikido::Zen
 
       response = request(
         Net::HTTP::Get.new("/config", default_headers),
-        base_url: @should_fetch_settings_endpoint
+        base_url: @config.realtime_endpoint,
+        timeout: @config.api_config_timeout
       )
 
       new_updated_at = Time.at(response["configUpdatedAt"].to_i)
       new_updated_at > last_updated_at
     end
 
-    # Fetches the runtime config from the server. In case of a timeout or
-    # other low-lever error, the request will be automatically retried up to two
-    # times, after which it will raise an error.
+    # Fetches the runtime config from the server. Requests are never retried;
+    # on a timeout or other low-level error this raises an error.
     #
     # @return [Hash] decoded JSON response from the server with the runtime
     #   settings.
@@ -61,7 +55,11 @@ module Aikido::Zen
     def fetch_runtime_config
       @config.logger.debug("Fetching new runtime config")
 
-      request(Net::HTTP::Get.new("/api/runtime/config", default_headers))
+      request(
+        Net::HTTP::Get.new("/api/runtime/config", default_headers),
+        base_url: @config.api_endpoint,
+        timeout: @config.api_config_timeout
+      )
     end
 
     def fetch_runtime_firewall_lists
@@ -71,7 +69,11 @@ module Aikido::Zen
         "Accept-Encoding" => "gzip"
       })
 
-      request(Net::HTTP::Get.new("/api/runtime/firewall/lists", headers))
+      request(
+        Net::HTTP::Get.new("/api/runtime/firewall/lists", headers),
+        base_url: @config.api_endpoint,
+        timeout: @config.api_config_timeout
+      )
     end
 
     # @overload report(event)
@@ -111,7 +113,7 @@ module Aikido::Zen
         @config.json_encoder.call(event)
       end
 
-      request(req)
+      request(req, base_url: @config.api_endpoint, timeout: @config.api_events_timeout)
     rescue Aikido::Zen::RateLimitedError
       @rate_limiter.open!
       raise
@@ -121,15 +123,16 @@ module Aikido::Zen
     # response.
     #
     # @param request [Net::HTTPRequest]
-    # @param base_url [URI] which API to use. Defaults to +Config#api_endpoint+.
+    # @param base_url [URI] which API to use.
+    # @param timeout [Numeric] seconds to wait on each connect, read and write.
     #
     # @return [Object] the result of decoding the JSON response from the server.
     #
     # @raise [Aikido::Zen::APIError] in case of a 4XX or 5XX response.
     # @raise [Aikido::Zen::NetworkError] if an error occurs trying to make the
     #   request.
-    private def request(request, base_url: @config.api_endpoint)
-      Net::HTTP.start(base_url.host, base_url.port, http_settings(base_url)) do |http|
+    private def request(request, base_url:, timeout:)
+      Net::HTTP.start(base_url.host, base_url.port, http_settings(base_url, timeout)) do |http|
         response = http.request(request)
 
         case response
@@ -168,11 +171,14 @@ module Aikido::Zen
       end
     end
 
-    private def http_settings(base_url)
-      @http_settings ||= {
+    private def http_settings(base_url, timeout)
+      {
         use_ssl: base_url.scheme == "https",
-        max_retries: 2
-      }.merge(@config.api_timeouts)
+        max_retries: 0,
+        open_timeout: timeout,
+        read_timeout: timeout,
+        write_timeout: timeout
+      }
     end
 
     private def default_headers
@@ -180,7 +186,7 @@ module Aikido::Zen
         "Authorization" => @config.api_token,
         "Accept" => "application/json",
         "User-Agent" => "#{@system_info.library_name} v#{@system_info.library_version}"
-      }
+      }.merge(@system_info.agent_headers)
     end
   end
 end

data/lib/aikido/zen/api_stream.rb

@@ -7,7 +7,9 @@ require "json"
 module Aikido::Zen
   class APIStream
     def initialize(
-      config: Aikido::Zen.config,
+      zen: Aikido::Zen,
+      config: zen.config,
+      system_info: zen.system_info,
       min_backoff: 5,
       max_backoff: 60,
       backoff_reset: 30,
@@ -16,6 +18,7 @@ module Aikido::Zen
       read_timeout: 70
     )
       @config = config
+      @system_info = system_info
       @min_backoff = min_backoff
       @max_backoff = max_backoff
       @backoff_reset = backoff_reset
@@ -123,8 +126,7 @@ module Aikido::Zen
       request["Authorization"] = @token
       request["Accept"] = "text/event-stream"
       request["Cache-Control"] = "no-cache"
-      request["X-Agent-Platform"] = "ruby"
-      request["X-Agent-Version"] = Aikido::Zen::VERSION
+      @system_info.agent_headers.each { |name, value| request[name] = value }
       # Working around Net::HTTP cleverness; auto-negotiates gzip and buffers
       # decompressed output internally.
       request["Accept-Encoding"] = "identity"

data/lib/aikido/zen/attack.rb

@@ -43,13 +43,19 @@ module Aikido::Zen
     end
 
     def as_json
-      {
+      attack_json = {
         "kind" => kind,
         "blocked" => blocked?,
         "metadata" => metadata,
         "operation" => @operation,
         "stack" => @stack
       }.compact.merge(input.as_json)
+
+      if (actor = @context&.request&.actor)
+        attack_json["user"] = {"id" => actor.id, "name" => actor.name}.compact
+      end
+
+      attack_json
     end
 
     def exception(*)
@@ -69,8 +75,10 @@ module Aikido::Zen
       end
 
       def metadata
+        safe_filepath = Aikido::Zen::Helpers.encode_safely(filepath)
+
         {
-          "filename" => filepath
+          "filename" => safe_filepath
         }
       end
 
@@ -106,8 +114,10 @@ module Aikido::Zen
       end
 
       def metadata
+        safe_command = Aikido::Zen::Helpers.encode_safely(@command)
+
         {
-          "command" => @command
+          "command" => safe_command
         }
       end
 
@@ -138,8 +148,10 @@ module Aikido::Zen
       end
 
       def metadata
+        safe_query = Aikido::Zen::Helpers.encode_safely(@query)
+
         {
-          "sql" => @query,
+          "sql" => safe_query,
           "dialect" => @dialect.name,
           "failedToTokenize" => @failed_to_tokenize || nil
         }.compact

data/lib/aikido/zen/config.rb

@@ -45,8 +45,15 @@ module Aikido::Zen
     #   +https://guard.aikido.dev+.
     attr_reader :realtime_endpoint
 
-    # @return [Hash] HTTP timeouts for communicating with the API.
-    attr_reader :api_timeouts
+    # @return [Numeric] the timeout in seconds for reporting events to the
+    #   API (+POST /api/runtime/events+). Applied to each connect, read and
+    #   write wait. Defaults to 60 seconds.
+    attr_accessor :api_events_timeout
+
+    # @return [Numeric] the timeout in seconds for fetching config, runtime
+    #   config and firewall lists from the API. Applied to each connect, read
+    #   and write wait. Defaults to 30 seconds.
+    attr_accessor :api_config_timeout
 
     # @return [Integer] the interval in seconds to poll the runtime API for
     #   settings changes. Defaults to evey 60 seconds.
@@ -56,6 +63,10 @@ module Aikido::Zen
     #   each initial heartbeat event.
     attr_accessor :initial_heartbeat_delays
 
+    # @return [Integer] the maximum number of levels deep we want to traverse
+    #   when extracting payloads from a nested request property. Defaults to 64.
+    attr_accessor :extract_payloads_max_depth
+
     # @return [Symbol] the agent mode for forked worker processes. Can be set
     #   through the AIKIDO_AGENT_MODE environment variable.
     attr_reader :agent_mode
@@ -107,6 +118,10 @@ module Aikido::Zen
     #   the oldest seen users.
     attr_accessor :max_users_tracked
 
+    # @return [Integer] the maximum number of custom events tracked per request.
+    #   Defaults to 25.
+    attr_accessor :max_custom_events
+
     # @return [Proc{(Aikido::Zen::Request, Symbol, reason: String=nil) => Array(Integer, Hash, #each)}]
     #   Rack handler used to respond to requests from IPs, users or others blocked in the Aikido
     #   dashboard.
@@ -246,9 +261,11 @@ module Aikido::Zen
       self.api_token = ENV.fetch("AIKIDO_TOKEN", nil)
       self.api_endpoint = ENV.fetch("AIKIDO_ENDPOINT") { regional_api_endpoint(api_token) }
       self.realtime_endpoint = api_endpoint
-      self.api_timeouts = 10
+      self.api_events_timeout = 60 # sec
+      self.api_config_timeout = 30 # sec
       self.polling_interval = 60 # 1 min
       self.initial_heartbeat_delays = [30, 60 * 2] # 30 sec, 2 min
+      self.extract_payloads_max_depth = 64
       self.agent_mode = ENV.fetch("AIKIDO_AGENT_MODE", "shared")
       self.worker_process_polling_interval = 10
       self.worker_process_polling_jitter = 10
@@ -261,6 +278,7 @@ module Aikido::Zen
       self.max_compressed_stats = 100
       self.max_outbound_connections = 200
       self.max_users_tracked = 1000
+      self.max_custom_events = 25
       self.blocked_responder = DEFAULT_BLOCKED_RESPONDER
       self.rate_limited_responder = DEFAULT_RATE_LIMITED_RESPONDER
       self.rate_limiting_discriminator = DEFAULT_RATE_LIMITING_DISCRIMINATOR
@@ -322,25 +340,6 @@ module Aikido::Zen
       @logger.level = Logger::DEBUG if debugging
     end
 
-    # @overload def api_timeouts=(timeouts)
-    #   Configure granular connection timeouts for the Aikido Zen API. You
-    #   can set any of these per call.
-    #   @param timeouts [Hash]
-    #   @option timeouts [Integer] :open_timeout Duration in seconds.
-    #   @option timeouts [Integer] :read_timeout Duration in seconds.
-    #   @option timeouts [Integer] :write_timeout Duration in seconds.
-    #
-    # @overload def api_timeouts=(duration)
-    #   Configure the connection timeouts for the Aikido Zen API.
-    #   @param duration [Integer] Duration in seconds to set for all three
-    #     timeouts (open, read, and write).
-    def api_timeouts=(value)
-      value = {open_timeout: value, read_timeout: value, write_timeout: value} if value.respond_to?(:to_int)
-
-      @api_timeouts ||= {}
-      @api_timeouts.update(value)
-    end
-
     def api_token_hash
       return unless api_token
 
@@ -442,7 +441,13 @@ module Aikido::Zen
 
     # @!visibility private
     DEFAULT_RATE_LIMITING_DISCRIMINATOR = ->(request) {
-      request.actor ? "actor:#{request.actor.id}" : request.client_ip
+      rate_limiting_group = request.rate_limiting_group
+      return "group:#{rate_limiting_group}" unless rate_limiting_group.nil?
+
+      actor = request.actor
+      return "actor:#{request.actor.id}" unless actor.nil?
+
+      request.client_ip
     }
   end
 end

data/lib/aikido/zen/context.rb

@@ -38,6 +38,9 @@ module Aikido::Zen
     attr_accessor :idor_protection_enabled
     alias_method :idor_protection_enabled?, :idor_protection_enabled
 
+    # @return [Integer]
+    attr_accessor :custom_events
+
     # @param request [Rack::Request] a Request object that implements the
     #   Rack::Request API, to which we will delegate behavior.
     # @param settings [Aikido::Zen::RuntimeSettings]
@@ -45,16 +48,20 @@ module Aikido::Zen
     # @yieldparam request [Rack::Request] the given request object.
     # @yieldreturn [Hash<Symbol, #flat_map>] map of payload source types
     #   to the actual data from the request to populate them.
-    def initialize(request, settings: Aikido::Zen.runtime_settings, &sources)
+    def initialize(request, zen: Aikido::Zen, config: zen.config, settings: zen.runtime_settings, &sources)
       @request = request
+      @config = config
       @settings = settings
       @payload_sources = sources
 
+      @max_depth = @config.extract_payloads_max_depth
+
       @metadata = {}
       @scanning = false
       @request_bypassed = nil
       @protection_disabled = false
       @idor_protection_enabled = false
+      @custom_events = 0
     end
 
     # Fetch some metadata stored in the Context.
@@ -102,31 +109,46 @@ module Aikido::Zen
     private
 
     # @!visibility private
-    def extract_payloads_from(data, source_type, prefix = nil)
+    def extract_payloads_from(data, source_type, prefix = nil, depth = 0)
+      return [] if depth > @max_depth
+
       if data.is_a?(String)
         [Payload.new(data, source_type, prefix.to_s)]
       elsif data.respond_to?(:to_hash)
         data.to_hash.flat_map do |key, value|
-          extract_payloads_from(value, source_type, [prefix, key].compact.join("."))
+          extract_payloads_from(value, source_type, [prefix, key].compact.join("."), depth + 1)
         end
       elsif data.respond_to?(:to_ary)
         array = data.to_ary
         return array if array.empty?
 
         payloads = array.flat_map.with_index do |value, index|
-          extract_payloads_from(value, source_type, [prefix, index].compact.join("."))
+          extract_payloads_from(value, source_type, [prefix, index].compact.join("."), depth + 1)
         end
 
         unless Aikido::Zen.config.harden?
           # Special case for File.join given a possibly nested array of strings,
           # as might occur when a query parameter is an array.
-          begin
-            string = File.join__internal_for_aikido_zen(*array)
-            if unsafe_path?(string)
-              payloads << Payload.new(string, source_type, [prefix, "__File.join__"].compact.join("."))
+
+          # File.join recursively joins nested string arrays, and can overflow
+          # the stack given deeply nested arrays.
+          #
+          # Flatten array to max depth and check that the flattened array is an
+          # array of strings before calling File.join__internal_for_aikido_zen,
+          # only if the array was fully flattened, to prevent a stack overflow.
+          #
+          # Checking that all values are Strings handily prevents a TypeError
+          # from being raised.
+          flattened_array = array.flatten(@max_depth)
+          if flattened_array.all? { |string| string.is_a?(String) }
+            begin
+              string = File.join__internal_for_aikido_zen(*flattened_array)
+              if unsafe_path?(string)
+                payloads << Payload.new(string, source_type, [prefix, "__File.join__"].compact.join("."))
+              end
+            rescue
+              # Could not create special payload for File.join.
             end
-          rescue
-            # Could not create special payload for File.join.
           end
         end
 

data/lib/aikido/zen/helpers.rb

@@ -29,6 +29,22 @@ module Aikido
 
         Regexp.new(regexp.source, regexp.options, timeout: timeout)
       end
+
+      # Returns a copy of the string safely encoded as UTF-8.
+      #
+      # Web servers may deliver request data as binary strings. These strings
+      # are relabeled as UTF-8 instead of being converted, because conversion
+      # would replace every non-ASCII byte with U+FFFD, even in valid UTF-8.
+      #
+      # @param string [String] the string
+      # @return [String] the valid UTF-8 string
+      def self.encode_safely(string)
+        if string.encoding == Encoding::BINARY
+          string.dup.force_encoding(Encoding::UTF_8).scrub
+        else
+          string.encode("UTF-8", invalid: :replace, undef: :replace)
+        end
+      end
     end
   end
 end

data/lib/aikido/zen/internals.rb

@@ -103,8 +103,8 @@ module Aikido::Zen
       # @raise [Aikido::Zen::InternalsError] if there's a problem loading or
       #   calling libzen.
       def self.detect_sql_injection(query, input, dialect)
-        query_bytes = encode_safely(query)
-        input_bytes = encode_safely(input)
+        query_bytes = Aikido::Zen::Helpers.encode_safely(query)
+        input_bytes = Aikido::Zen::Helpers.encode_safely(input)
 
         query_ptr = FFI::MemoryPointer.new(:uint8, query_bytes.bytesize)
         input_ptr = FFI::MemoryPointer.new(:uint8, input_bytes.bytesize)
@@ -123,7 +123,7 @@ module Aikido::Zen
       end
 
       def self.idor_analyze_sql(query, dialect)
-        query_bytes = encode_safely(query)
+        query_bytes = Aikido::Zen::Helpers.encode_safely(query)
         query_ptr = FFI::MemoryPointer.new(:uint8, query_bytes.bytesize)
         query_ptr.put_bytes(0, query_bytes)
 
@@ -134,13 +134,5 @@ module Aikido::Zen
         JSON.parse(result_json)
       end
     end
-
-    class << self
-      private
-
-      def encode_safely(string)
-        string.encode("UTF-8", invalid: :replace, undef: :replace)
-      end
-    end
   end
 end

data/lib/aikido/zen/payload.rb

@@ -24,10 +24,13 @@ module Aikido::Zen
     end
 
     def as_json
+      safe_value = Aikido::Zen::Helpers.encode_safely(value.to_s)
+      safe_path = Aikido::Zen::Helpers.encode_safely(path.to_s)
+
       {
-        "payload" => value.to_s,
+        "payload" => safe_value,
         "source" => SOURCE_SERIALIZATIONS[source],
-        "path" => ".#{path}"
+        "path" => ".#{safe_path}"
       }
     end
 

data/lib/aikido/zen/request.rb

@@ -17,6 +17,11 @@ module Aikido::Zen
     # @see Aikido::Zen.track_user
     attr_accessor :actor
 
+    # The current rate limiting group, if set by the host app.
+    #
+    # @return [String, nil]
+    attr_accessor :rate_limiting_group
+
     # The current tenant, if set by the host app.
     #
     # @return [Integer, String, nil]
@@ -86,13 +91,17 @@ module Aikido::Zen
     end
 
     def as_json
+      safe_url = Aikido::Zen::Helpers.encode_safely(url)
+      safe_user_agent = Aikido::Zen::Helpers.encode_safely(user_agent) if user_agent
+      safe_route_path = Aikido::Zen::Helpers.encode_safely(route.path) if route&.path
+
       {
         "method" => request_method.upcase,
-        "url" => url,
+        "url" => safe_url,
         "ipAddress" => client_ip,
-        "userAgent" => user_agent,
+        "userAgent" => safe_user_agent,
         "source" => framework,
-        "route" => route&.path
+        "route" => safe_route_path
       }
     end
 

data/lib/aikido/zen/scanners/path_traversal_scanner.rb

@@ -40,8 +40,8 @@ module Aikido::Zen
       end
 
       def initialize(filepath, input)
-        @filepath = filepath.downcase
-        @input = input.downcase
+        @filepath = Aikido::Zen::Helpers.encode_safely(filepath).downcase
+        @input = Aikido::Zen::Helpers.encode_safely(input).downcase
       end
 
       def attack?

data/lib/aikido/zen/scanners/shell_injection_scanner.rb

@@ -37,8 +37,8 @@ module Aikido::Zen
       # @param command [String]
       # @param input [String]
       def initialize(command, input)
-        @command = command
-        @input = input
+        @command = Aikido::Zen::Helpers.encode_safely(command)
+        @input = Aikido::Zen::Helpers.encode_safely(input)
       end
 
       def attack?

data/lib/aikido/zen/scanners/sql_injection_scanner.rb

@@ -53,8 +53,8 @@ module Aikido::Zen
       attr_reader :failed_to_tokenize
 
       def initialize(query, input, dialect)
-        @query = query.downcase
-        @input = input.downcase.strip
+        @query = Aikido::Zen::Helpers.encode_safely(query).downcase
+        @input = Aikido::Zen::Helpers.encode_safely(input).downcase.strip
         @dialect = dialect
       end
 

data/lib/aikido/zen/scanners/ssrf/private_ip_checker.rb

@@ -85,9 +85,11 @@ module Aikido::Zen
         # Matches strings that contain only characters that appear in some
         # form of IP address.
         #
+        # An IPv6 zone ID (e.g. "%eth0") may follow the address.
+        #
         # Hostnames are not expected to match, allowing `parse_address` to
         # skip the `Socket.getaddrinfo` call.
-        ADDRESS_REGEXP = /\A[0-9a-fx:.]+\z/i
+        ADDRESS_REGEXP = /\A[0-9a-fx:.]+(?:%[^%\s]+)?\z/i
 
         # Parses `address` as an IP address, in any form that is accepted
         # by `getaddrinfo`:
@@ -96,6 +98,7 @@ module Aikido::Zen
         # * Plain integer IPv4 notation, in decimal, octal, or hexadecimal
         #   (e.g. "2130706433", "017700000001", "0x7f000001")
         # * Shorthand dotted IPv4 notation (e.g. "127.1")
+        # * IPv6 notation with zone ID (e.g. "fe80::1%eth0")
         #
         # Delegates to `Socket.getaddrinfo` with the `AI_NUMERICHOST` flag,
         # which never performs a DNS lookup.
@@ -105,8 +108,10 @@ module Aikido::Zen
         def parse_address(address)
           return nil unless address.is_a?(String) && ADDRESS_REGEXP.match?(address)
 
-          Socket.getaddrinfo(address, nil, :UNSPEC, :STREAM, nil, Socket::AI_NUMERICHOST)
-            .map { |info| IPAddr.new(info[3]) }
+          Socket.getaddrinfo(address, nil, :UNSPEC, :STREAM, nil, Socket::AI_NUMERICHOST).map do |info|
+            # `IPAddr.new` only accepts a zone ID on Ruby 3.1+.
+            IPAddr.new(info[3].partition("%").first)
+          end
         rescue SocketError
           nil
         end

data/lib/aikido/zen/scanners/ssrf_scanner.rb

@@ -146,7 +146,9 @@ module Aikido::Zen
       #
       # @return [Array<URI>] a list of unique URIs based on the above criteria.
       def uris_from_input
-        input = @input.to_s
+        # Percent-encode input so URI() can parse it, as an app may do before
+        # making the request.
+        input = percent_encode(@input.to_s)
 
         # If you build a URI manually and set the hostname to an IPv6 string,
         # the URI library will be helpful to wrap it in brackets so it's a
@@ -167,6 +169,17 @@ module Aikido::Zen
         nil
       end
 
+      # Matches bytes not allowed in a URI (RFC 3986): any byte other than
+      # the unreserved and reserved characters, and any "%" that does not
+      # start a percent-encoded byte.
+      NOT_ALLOWED_IN_URI = /%(?![0-9A-Fa-f]{2})|[^A-Za-z0-9\-._~:\/?#\[\]@!$&'()*+,;=%]/n
+
+      # Percent-encodes characters not allowed in a URI, preserving existing
+      # percent-encoding.
+      def percent_encode(string)
+        string.b.gsub(NOT_ALLOWED_IN_URI) { |byte| format("%%%02X", byte.ord) }
+      end
+
       # Check if the input is an IPv6 that is not surrounded by square brackets.
       def unescaped_ipv6?(input)
         (

data/lib/aikido/zen/sink.rb

@@ -85,36 +85,40 @@ module Aikido::Zen
     # @raise [Aikido::UnderAttackError] if an attack is detected and
     #   blocking_mode is enabled.
     def scan(context: Aikido::Zen.current_context, **scan_params)
+      # Nested scans must return early without clearing the scanning state.
       return if context&.scanning
+
       context&.scanning = true
 
-      return if context&.protection_disabled?
+      begin
+        return if context&.protection_disabled?
 
-      scan = Scan.new(sink: self, context: context)
+        scan = Scan.new(sink: self, context: context)
 
-      scans_performed = 0
-      scan.perform do
-        result = nil
+        scans_performed = 0
+        scan.perform do
+          result = nil
 
-        scanners.each do |scanner|
-          next if scanner.skips_on_nil_context? && context.nil?
+          scanners.each do |scanner|
+            next if scanner.skips_on_nil_context? && context.nil?
 
-          result = scanner.call(scan: scan, sink: self, context: context, **scan_params)
-          scans_performed += 1
+            result = scanner.call(scan: scan, sink: self, context: context, **scan_params)
+            scans_performed += 1
 
-          break result if result
-        rescue => error
-          scan.track_error(error, scanner)
-        end
+            break result if result
+          rescue => error
+            scan.track_error(error, scanner)
+          end
 
-        result
-      end
+          result
+        end
 
-      @reporter.call(scan) if scans_performed > 0
+        @reporter.call(scan) if scans_performed > 0
 
-      scan
-    ensure
-      context&.scanning = false
+        scan
+      ensure
+        context&.scanning = false
+      end
     end
   end
 end

data/lib/aikido/zen/system_info.rb

@@ -1,13 +1,21 @@
 # frozen_string_literal: true
 
 require "socket"
+require "securerandom"
 require "rubygems"
 
 require_relative "package"
 
 module Aikido::Zen
-  # Provides information about the currently running Agent.
+  # Provides information about the currently running agent.
   class SystemInfo
+    # @return [String] a unique identifier for the currently running agent.
+    attr_reader :session_id
+
+    def initialize
+      @session_id = generate_session_id
+    end
+
     def attacks_block_requests?
       !!Aikido::Zen.blocking_mode?
     end
@@ -28,8 +36,29 @@ module Aikido::Zen
       RUBY_VERSION
     end
 
+    # @return [String, nil] the hostname, or nil if it cannot be determined.
     def hostname
-      @hostname ||= Socket.gethostname
+      @hostname ||= begin
+        name = Socket.gethostname.to_s
+        name unless name.empty?
+      rescue SystemCallError
+        nil
+      end
+    end
+
+    # Headers sent with every request to the Aikido server to describe and
+    # identify the currently running agent.
+    #
+    # @return [Hash{String => String}] the agent headers, keyed by header name.
+    def agent_headers
+      {
+        "X-Agent-Platform" => "ruby",
+        "X-Agent-Library" => library_name,
+        "X-Agent-Version" => library_version,
+        "X-Agent-Hostname" => hostname || "unknown",
+        "X-Agent-IP-Address" => ip_address || "unknown",
+        "X-Agent-Session-Id" => session_id
+      }
     end
 
     # @return [Array<Aikido::Zen::Package>] a list of loaded rubygems that are
@@ -41,14 +70,18 @@ module Aikido::Zen
         .select(&:supported?)
     end
 
-    # @return [String] the first non-loopback IPv4 address that we can use
-    #   to identify this host. If the machine is solely identified by IPv6
-    #   addresses, then this will instead return an IPv6 address.
+    # Find the first non-loopback IP address, preferring IPv4.
+    #
+    # @return [String, nil] the IP address, or nil if it cannot be determined.
     def ip_address
-      @ip_address ||= Socket.ip_address_list
-        .reject { |ip| ip.ipv4_loopback? || ip.ipv6_loopback? || ip.unix? }
-        .min_by { |ip| ip.ipv4? ? 0 : 1 }
-        .ip_address
+      @ip_address ||= begin
+        address = Socket.ip_address_list
+          .reject { |ip| ip.ipv4_loopback? || ip.ipv6_loopback? || ip.unix? }
+          .min_by { |ip| ip.ipv4? ? 0 : 1 }
+        address&.ip_address
+      rescue SystemCallError
+        nil
+      end
     end
 
     def os_name
@@ -76,5 +109,17 @@ module Aikido::Zen
         "preventedPrototypePollution" => false
       }
     end
+
+    private def generate_session_id
+      # Code coverage is disabled here because `SecureRandom.uuid_v7` is only
+      # defined in Ruby 3.3+.
+      # :nocov:
+      if SecureRandom.respond_to?(:uuid_v7)
+        SecureRandom.uuid_v7
+      else
+        SecureRandom.uuid
+      end
+      # :nocov:
+    end
   end
 end

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.9.0.beta.3"
+    VERSION = "1.9.1"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.74"

data/lib/aikido/zen/worker_process/agent/client.rb

@@ -64,7 +64,10 @@ module Aikido::Zen::WorkerProcess
       def calculate_rate_limits(request)
         result = @rpc_client.invoke(
           "calculate_rate_limits", Aikido::Zen::IPC::READ_TIMEOUT,
-          request.route.as_json, request.client_ip, request.actor&.as_json
+          request.route.as_json,
+          request.client_ip,
+          request.actor&.as_json,
+          request.rate_limiting_group
         )
 
         Aikido::Zen::RateLimiter::Result.from_json(result) if result

data/lib/aikido/zen/worker_process/agent/server.rb

@@ -22,8 +22,8 @@ module Aikido::Zen::WorkerProcess
           send_collector_events(events_data)
         end
 
-        @rpc_server.handle("calculate_rate_limits") do |respond, route_data, ip, actor_data|
-          result = calculate_rate_limits(route_data, ip, actor_data)
+        @rpc_server.handle("calculate_rate_limits") do |respond, route_data, ip, actor_data, rate_limiting_group|
+          result = calculate_rate_limits(route_data, ip, actor_data, rate_limiting_group)
           respond.call(result&.as_json)
         end
 
@@ -66,7 +66,7 @@ module Aikido::Zen::WorkerProcess
 
       # @api private
       # @note Visible for testing.
-      RequestKind = Struct.new(:route, :schema, :client_ip, :actor)
+      RequestKind = Struct.new(:route, :schema, :client_ip, :actor, :rate_limiting_group)
 
       def updated_settings(known_config_generation = nil, known_firewall_lists_generation = nil)
         result = {}
@@ -91,10 +91,10 @@ module Aikido::Zen::WorkerProcess
         end
       end
 
-      def calculate_rate_limits(route_data, ip, actor_data)
+      def calculate_rate_limits(route_data, ip, actor_data, rate_limiting_group)
         actor = Aikido::Zen::Actor.from_json(actor_data) if actor_data
         route = Aikido::Zen::Route.from_json(route_data)
-        Aikido::Zen.rate_limiter.calculate_rate_limits(RequestKind.new(route, nil, ip, actor))
+        Aikido::Zen.rate_limiter.calculate_rate_limits(RequestKind.new(route, nil, ip, actor, rate_limiting_group))
       end
 
       # @return [Array<Hash>, nil]

data/lib/aikido/zen.rb

@@ -278,6 +278,37 @@ module Aikido
       alias_method :set_user, :track_user
     end
 
+    # Set the rate limiting group.
+    #
+    # @param group [String, Integer] the rate limiting group id
+    # @return [void]
+    def self.set_rate_limiting_group(group)
+      return if config.disabled?
+
+      if group.nil? || group == ""
+        config.logger.warn("set_rate_limiting_group expects a non-empty group")
+        return
+      end
+
+      unless group.is_a?(String) || group.is_a?(Integer)
+        config.logger.warn("set_rate_limiting_group expects a String or Integer group, got #{group.class}")
+        return
+      end
+
+      context = current_context
+      if context.nil?
+        config.logger.warn("set_rate_limiting_group was called without a context")
+        return
+      end
+
+      context.request.rate_limiting_group = group.to_s
+    end
+
+    # Align with other Zen implementations, while keeping internal consistency.
+    class << self
+      alias_method :set_rate_limit_group, :set_rate_limiting_group
+    end
+
     # Track a custom event happening in your application, like a failed login or
     # a password reset request. Zen automatically attaches the IP address, user
     # agent, and current user (if you called .track_user) from the request.
@@ -300,6 +331,13 @@ module Aikido
 
       return if request_bypassed?
 
+      if context.custom_events >= config.max_custom_events
+        config.logger.warn("Dropped custom event #{name}: too many custom events were tracked for this request")
+        return
+      end
+
+      context.custom_events += 1
+
       event = Events::Custom.new(
         name: name,
         request: context.request,
@@ -522,6 +560,7 @@ module Aikido
         @agent = nil
         agent&.stop!
 
+        @system_info = nil
         @agent = Agent.start
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.9.0.beta.3
+  version: 1.9.1
 platform: arm64-linux
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-01 00:00:00.000000000 Z
+date: 2026-10-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby