aikido-zen 1.4.1 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea0d03f79f4de77618d118402c5e77d661f595d711651c1776cbba978323c3dc
-  data.tar.gz: 8c01f5d718ce07261e84351db938b8b5bebf3a4bf7b9fc1a4c691686adb3d670
+  metadata.gz: 2a9cc243a2ca18ad42f75596db9fb9558362371ee68646f2f75997b80dfd9d04
+  data.tar.gz: 7f9990113775ca615b9b50035a15779e5a9ceb777ad793c164dc6b69c8898732
 SHA512:
-  metadata.gz: e01c0bfada461c9884c0846c3ddebd949cb803767018fcfcb12d0c7f36e27ae4eebc9f84269b73970c984754b326645e7139dd788ed030e7d851cdfb7ae93fb3
-  data.tar.gz: 9a5fcf35a47e825ce3b39dd556cf58a68feb49d1eee79b9e9ea96e0bf9afe42f4f6e00948d33c23c9fe31f0d7c40651afb1681406a7f63e7055d6354f89fdcc9
+  metadata.gz: 0f4711a8dacc3597ea2a143cb50e735f3234af4d8fcfa0f3d76bf993de51dc17a19c6967c338119cb0433d2c6a850a363a96a6326259316c9d2fc5d346c3809c
+  data.tar.gz: 1d85b479341bec9f2a4ad9b9b8bf12bfc71dbd98213a6020b8c03fde0ea3a6cea47c9e1a6c0f5895474c8e8de3cac823d655cf59396c16309640a45c976cb68b

data/lib/aikido/zen/agent.rb

@@ -21,15 +21,20 @@ module Aikido::Zen
       collector: Aikido::Zen.collector,
       detached_agent: Aikido::Zen.detached_agent,
       worker: Aikido::Zen::Worker.new(config: config),
-      api_client: Aikido::Zen::APIClient.new(config: config)
+      api_client: Aikido::Zen::APIClient.new(config: config),
+      api_stream: Aikido::Zen::APIStream.new(config: config)
     )
-      @started_at = nil
-
       @config = config
-      @worker = worker
-      @api_client = api_client
       @collector = collector
       @detached_agent = detached_agent
+      @worker = worker
+      @api_client = api_client
+      @api_stream = api_stream
+
+      @started_at = nil
+
+      @runtime_config_update_mutex = Mutex.new
+      @runtime_firewall_lists_update_mutex = Mutex.new
     end
 
     def started?
@@ -59,7 +64,7 @@ module Aikido::Zen
       at_exit { stop! if started? }
 
       report(Events::Started.new(time: @started_at)) do |response|
-        if Aikido::Zen.runtime_settings.update_from_runtime_config_json(response)
+        if update_settings_from_runtime_config!(response)
           updated_settings!
           @config.logger.info("Updated runtime settings")
         end
@@ -68,12 +73,25 @@ module Aikido::Zen
       end
 
       begin
-        Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(@api_client.fetch_runtime_firewall_lists)
+        update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
         @config.logger.info("Updated runtime firewall list")
       rescue => err
         @config.logger.error(err.message)
       end
 
+      if @config.realtime_settings_updates_enabled?
+        if @api_stream.can_connect?
+          @api_stream.handle("config-updated") { |event| settings_updated(event) }
+          @api_stream.start!
+
+          # Use the realtime setting updates endpoint when polling to check
+          # whether settings should be fetched.
+          @api_client.should_fetch_settings_endpoint = @config.realtime_settings_updates_endpoint
+        else
+          @config.logger.warn("Can't reach #{Aikido::Zen.config.realtime_settings_updates_endpoint}, make sure it's in your outbound firewall allowlist. Realtime config updates won't be available, switched to polling.")
+        end
+      end
+
       poll_for_setting_updates
 
       @config.initial_heartbeat_delays.each do |heartbeat_delay|
@@ -92,6 +110,8 @@ module Aikido::Zen
       @config.logger.info("Stopping Aikido agent")
       @started_at = nil
       @worker.shutdown
+
+      @api_stream.stop!
     end
 
     # Respond to the runtime settings changing after being fetched from the
@@ -157,11 +177,11 @@ module Aikido::Zen
 
       heartbeat = @collector.flush
       report(heartbeat) do |response|
-        if Aikido::Zen.runtime_settings.update_from_runtime_config_json(response)
+        if update_settings_from_runtime_config!(response)
           updated_settings!
           @config.logger.info("Updated runtime settings after heartbeat")
 
-          Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(@api_client.fetch_runtime_firewall_lists)
+          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
           @config.logger.info("Updated runtime firewall list after heartbeat")
         end
       end
@@ -177,23 +197,68 @@ module Aikido::Zen
     def poll_for_setting_updates
       @worker.every(@config.polling_interval) do
         if @api_client.should_fetch_settings?
-          if Aikido::Zen.runtime_settings.update_from_runtime_config_json(@api_client.fetch_runtime_config)
+          if update_settings_from_runtime_config!(@api_client.fetch_runtime_config)
             updated_settings!
             @config.logger.info("Updated runtime settings after polling")
           end
 
-          Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(@api_client.fetch_runtime_firewall_lists)
+          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
           @config.logger.info("Updated runtime firewall list after polling")
         end
       end
     end
 
-    private def heartbeats
+    private
+
+    def settings_updated(event)
+      updated_at = Time.at(event[:data]["configUpdatedAt"].to_i)
+
+      if should_fetch_settings?(updated_at)
+        if update_settings_from_runtime_config!(@api_client.fetch_runtime_config)
+          updated_settings!
+          @config.logger.info("Updated runtime settings after server-side event")
+
+          update_settings_from_runtime_firewall_lists!(@api_client.fetch_runtime_firewall_lists)
+          @config.logger.info("Updated runtime firewall list after server-side event")
+        end
+      end
+    end
+
+    def should_fetch_settings?(updated_at, last_updated_at = Aikido::Zen.runtime_settings.updated_at)
+      return false unless @api_client.can_make_requests?
+      return true if last_updated_at.nil?
+
+      updated_at > last_updated_at
+    end
+
+    def heartbeats
       @heartbeats ||= Aikido::Zen::Agent::HeartbeatsManager.new(
         config: @config,
         worker: @worker
       )
     end
+
+    # @param data [Hash]
+    # @return [Boolean]
+    def update_settings_from_runtime_config!(data)
+      return unless @runtime_config_update_mutex.try_lock
+      begin
+        Aikido::Zen.runtime_settings.update_from_runtime_config_json(data)
+      ensure
+        @runtime_config_update_mutex.unlock
+      end
+    end
+
+    # @param data [Hash]
+    # @return [Boolean]
+    def update_settings_from_runtime_firewall_lists!(data)
+      return unless @runtime_firewall_lists_update_mutex.try_lock
+      begin
+        Aikido::Zen.runtime_settings.update_from_runtime_firewall_lists_json(data)
+      ensure
+        @runtime_firewall_lists_update_mutex.unlock
+      end
+    end
   end
 end
 

data/lib/aikido/zen/api_client.rb

@@ -16,6 +16,12 @@ module Aikido::Zen
       @config = config
       @system_info = system_info
       @rate_limiter = rate_limiter
+
+      @should_fetch_settings_endpoint = @config.realtime_endpoint
+    end
+
+    def should_fetch_settings_endpoint=(uri)
+      @should_fetch_settings_endpoint = URI(uri)
     end
 
     # @return [Boolean] whether we have a configured token.
@@ -38,10 +44,10 @@ module Aikido::Zen
 
       response = request(
         Net::HTTP::Get.new("/config", default_headers),
-        base_url: @config.realtime_endpoint
+        base_url: @should_fetch_settings_endpoint
       )
 
-      new_updated_at = Time.at(response["configUpdatedAt"].to_i / 1000)
+      new_updated_at = Time.at(response["configUpdatedAt"].to_i)
       new_updated_at > last_updated_at
     end
 

data/lib/aikido/zen/api_stream.rb

@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+require "json"
+
+module Aikido::Zen
+  class APIStream
+    def initialize(
+      config: Aikido::Zen.config,
+      min_backoff: 5,
+      max_backoff: 60,
+      backoff_reset: 30,
+      open_timeout: 5,
+      write_timeout: open_timeout,
+      read_timeout: 70
+    )
+      @config = config
+      @min_backoff = min_backoff
+      @max_backoff = max_backoff
+      @backoff_reset = backoff_reset
+      @open_timeout = open_timeout
+      @write_timeout = write_timeout
+      @read_timeout = read_timeout
+
+      @running = Concurrent::AtomicBoolean.new
+      @thread = nil
+      @http = nil
+
+      endpoint = @config.realtime_settings_updates_endpoint
+
+      @host = endpoint.host
+      @port = endpoint.port
+      @use_ssl = endpoint.scheme == "https"
+      @token = @config.api_token
+
+      @handlers = Concurrent::Array.new
+    end
+
+    # @return [Boolean] whether we could connect to the realtime endpoint
+    def can_connect?
+      http = Net::HTTP.new(@host, @port)
+      http.use_ssl = @use_ssl
+      http.open_timeout = 5
+      http.write_timeout = 5
+      http.read_timeout = 5
+      http.max_retries = 0
+
+      request = Net::HTTP::Get.new("/config")
+      request["Authorization"] = @token
+
+      begin
+        http.request(request)
+
+        return true
+      rescue Timeout::Error, SocketError, IOError, SystemCallError, OpenSSL::OpenSSLError => err
+        @config.logger.debug("Error probing realtime endpoint: #{err.class}: #{err.message}")
+      rescue => err
+        @config.logger.error("Error probing realtime endpoint: #{err.class}: #{err.message}")
+      end
+
+      false
+    end
+
+    def running?
+      @running.true?
+    end
+    alias_method :started?, :running?
+
+    def start!
+      return false unless @running.make_true
+
+      @thread = Thread.new do
+        backoff = @min_backoff
+
+        while running?
+          time_before = Process.clock_gettime(Process::CLOCK_MONOTONIC, :second)
+
+          begin
+            work
+          rescue IOError => err
+            @config.logger.debug("Error in API stream: #{err.class}: #{err.message}") if running?
+          rescue Timeout::Error, SocketError, SystemCallError, OpenSSL::OpenSSLError => err
+            @config.logger.debug("Error in API stream: #{err.class}: #{err.message}")
+          rescue => err
+            @config.logger.error("Error in API stream: #{err.class}: #{err.message}")
+          end
+
+          break unless running?
+
+          time_after = Process.clock_gettime(Process::CLOCK_MONOTONIC, :second)
+
+          backoff = if time_after - time_before > @backoff_reset
+            @min_backoff
+          else
+            [backoff * 2, @max_backoff].min
+          end
+
+          jitter = rand * backoff / 2
+
+          @config.logger.debug("API stream reconnecting in %d seconds" % (backoff + jitter).ceil)
+
+          sleep(backoff + jitter)
+        end
+      end
+
+      true
+    end
+
+    def stop!
+      return false unless @running.make_false
+
+      begin
+        @http&.finish
+      rescue IOError
+        # ignore error
+      end
+
+      begin
+        @thread&.wakeup
+      rescue ThreadError
+        # ignore error
+      end
+
+      @thread.join(@read_timeout)
+
+      true
+    end
+
+    def handle(type, &block)
+      raise ArgumentError, "block required" unless block
+
+      @handlers << proc do |event|
+        block.call(event) if type === event[:type]
+      end
+    end
+
+    private def work
+      http = Net::HTTP.new(@host, @port)
+      http.use_ssl = @use_ssl
+      http.open_timeout = @open_timeout
+      http.write_timeout = @write_timeout
+      http.read_timeout = @read_timeout
+      http.max_retries = 0
+
+      request = Net::HTTP::Get.new("/api/runtime/stream")
+      request["Authorization"] = @token
+      request["Accept"] = "text/event-stream"
+      request["Cache-Control"] = "no-cache"
+
+      @config.logger.debug("API stream connecting")
+      http.start
+      @config.logger.debug("API stream connected")
+
+      @http = http
+
+      begin
+        http.request(request) do |response|
+          case response.code.to_i
+          when 200
+            # empty
+          when 401, 403
+            @running.make_false
+            return nil
+          else
+            return nil
+          end
+
+          buffer = +""
+
+          response.read_body do |chunk|
+            return nil unless running?
+
+            @config.logger.debug("API stream received chunk of #{chunk.bytesize} bytes")
+
+            buffer << chunk
+
+            while (index = buffer.index("\n\n"))
+              event_str = buffer.slice!(0..index + 1)
+              buffer = buffer.lstrip
+
+              event = {}
+
+              begin
+                event_str.each_line do |line|
+                  case line
+                  when /^event:\s*(.+)/
+                    event[:type] = $1.strip
+                  when /^data:\s*(.+)/
+                    event[:data] = JSON.parse($1.strip)
+                  end
+                end
+              rescue => err
+                @config.logger.error("Error in API stream: #{err.class}: #{err.message}")
+                next
+              end
+
+              @handlers.each do |handler|
+                handler.call(event)
+              rescue => err
+                @config.logger.error("Error in API stream: #{err.class}: #{err.message}")
+              end
+            end
+          end
+        end
+      ensure
+        @config.logger.debug("API stream disconnecting")
+
+        @http = nil
+
+        http.finish if http.started?
+
+        @config.logger.debug("API stream disconnected")
+      end
+    end
+  end
+end

data/lib/aikido/zen/attack_wave/helpers.rb

@@ -1,27 +1,29 @@
 # frozen_string_literal: true
 
+require "set"
+
 module Aikido::Zen
   module AttackWave
     module Helpers
-      def self.web_scanner?(context)
-        return true if suspicious_request?(context)
+      def self.web_scanner?(context, status_code)
+        return true if suspicious_request?(context, status_code)
 
         return true if include_suspicious_payload?(context)
 
         false
       end
 
-      def self.suspicious_request?(context)
+      def self.suspicious_request?(context, status_code)
         request = context.request
 
-        suspicious_method?(request.request_method) || suspicious_path?(request.path_info)
+        suspicious_method?(request.request_method) || suspicious_path?(request.path_info, status_code)
       end
 
       def self.suspicious_method?(method)
         SUSPICIOUS_METHODS.include?(method.downcase)
       end
 
-      def self.suspicious_path?(path)
+      def self.suspicious_path?(path, status_code)
         path_parts = path.downcase.split("/")
 
         file_name = path_parts.pop if path_parts.length > 0
@@ -34,6 +36,8 @@ module Aikido::Zen
           file_extension = file_name_parts.pop if file_name_parts.length > 1
 
           return true if SUSPICIOUS_FILE_EXTENSIONS.include?(file_extension)
+
+          return true if FOREIGN_EXTENSIONS.include?(file_extension) && status_code == 404
         end
 
         path_parts.any? do |directory_name|
@@ -434,6 +438,11 @@ module Aikido::Zen
         "sqlite3db"
       ].map(&:downcase).freeze
 
+      # Extensions that a Ruby app would not natively serve. Requests to these
+      # paths are only treated as scan hits when the response is 404 — a 200
+      # may indicate the app is proxying to a PHP/Java backend.
+      FOREIGN_EXTENSIONS = Set.new(%w[php php3 php4 php5 phtml java jsp jspx]).freeze
+
       SUSPICIOUS_SQL_KEYWORDS = [
         "SELECT (CASE WHEN",
         "SELECT COUNT(",

data/lib/aikido/zen/attack_wave.rb

@@ -21,14 +21,14 @@ module Aikido::Zen
         end
       end
 
-      def attack_wave?(context)
+      def attack_wave?(context, status_code = nil)
         client_ip = context.request.client_ip
 
         return false unless client_ip
 
         return false if @event_times[client_ip]
 
-        return false unless AttackWave::Helpers.web_scanner?(context)
+        return false unless AttackWave::Helpers.web_scanner?(context, status_code)
 
         request_count = @request_counts[client_ip] += 1
 

data/lib/aikido/zen/config.rb

@@ -216,6 +216,15 @@ module Aikido::Zen
     #   Defaults to 1000 entries.
     attr_accessor :idor_max_cache_entries
 
+    # @return [Boolean] whether the realtime settings updates feature is enabled.
+    #   Defaults to false.
+    attr_accessor :realtime_settings_updates_enabled
+    alias_method :realtime_settings_updates_enabled?, :realtime_settings_updates_enabled
+
+    # @return [URI] The HTTP host for realtime settings updates.
+    #  Defaults to +https://zen.aikido.dev+.
+    attr_reader :realtime_settings_updates_endpoint
+
     def initialize
       self.insert_middleware_after = ::ActionDispatch::RemoteIp
       self.disabled = read_boolean_from_env(ENV.fetch("AIKIDO_DISABLE", false)) || read_boolean_from_env(ENV.fetch("AIKIDO_DISABLED", false))
@@ -261,6 +270,8 @@ module Aikido::Zen
       self.idor_tenant_column_name = nil
       self.idor_excluded_table_names = []
       self.idor_max_cache_entries = 1000
+      self.realtime_settings_updates_enabled = false
+      self.realtime_settings_updates_endpoint = ENV.fetch("AIKIDO_REALTIME_SETTINGS_UPDATES_ENDPOINT", DEFAULT_REALTIME_SETTINGS_UPDATES_BASE_URL)
     end
 
     # Set the base URL for API requests.
@@ -277,6 +288,13 @@ module Aikido::Zen
       @realtime_endpoint = URI(url)
     end
 
+    # Set the base URL for the realtime settings updates feature.
+    #
+    # @param url [String, URI]
+    def realtime_settings_updates_endpoint=(url)
+      @realtime_settings_updates_endpoint = URI(url)
+    end
+
     # Set the logger and configure its severity level according to agent's debug mode
     # @param logger [::Logger]
     def logger=(logger)
@@ -346,6 +364,9 @@ module Aikido::Zen
     # @!visibility private
     DEFAULT_RUNTIME_BASE_URL = "https://runtime.aikido.dev"
 
+    # @!visibility private
+    DEFAULT_REALTIME_SETTINGS_UPDATES_BASE_URL = "https://zen.aikido.dev"
+
     # @!visibility private
     DEFAULT_JSON_ENCODER = JSON.method(:dump)
 

data/lib/aikido/zen/middleware/attack_wave_protector.rb

@@ -12,28 +12,29 @@ module Aikido
 
         def call(env)
           response = @app.call(env)
+          status_code = response[0].to_i
 
           context = @zen.current_context
-          protect(context)
+          protect(context, status_code)
 
           response
         end
 
         # @api private
         # Visible for testing.
-        def attack_wave?(context)
+        def attack_wave?(context, status_code = nil)
           request = context.request
           return false if request.nil?
 
           return false if @settings.bypassed_ips.include?(request.client_ip)
 
-          @zen.attack_wave_detector.attack_wave?(context)
+          @zen.attack_wave_detector.attack_wave?(context, status_code)
         end
 
         # @api private
         # Visible for testing.
-        def protect(context)
-          if attack_wave?(context)
+        def protect(context, status_code = nil)
+          if attack_wave?(context, status_code)
             client_ip = context.request.client_ip
 
             request = Aikido::Zen::AttackWave::Request.new(

data/lib/aikido/zen/runtime_settings.rb

@@ -80,11 +80,11 @@ module Aikido::Zen
     #
     # @param data [Hash] the decoded JSON payload from the /api/runtime/config
     #   API endpoint.
-    # @return [bool]
+    # @return [Boolean]
     def update_from_runtime_config_json(data)
       last_updated_at = updated_at
 
-      self.updated_at = Time.at(data["configUpdatedAt"].to_i / 1000)
+      self.updated_at = Time.at(data["configUpdatedAt"].to_i)
       self.heartbeat_interval = data["heartbeatIntervalInMS"].to_i / 1000
       self.endpoints = RuntimeSettings::Endpoints.from_json(data["endpoints"])
       self.blocked_user_ids = data["blockedUserIds"]
@@ -105,7 +105,7 @@ module Aikido::Zen
     #
     # @param data [Hash] the decoded JSON payload from the /api/runtime/firewall/lists
     #   API endpoint.
-    # @return [void]
+    # @return [Boolean]
     def update_from_runtime_firewall_lists_json(data)
       self.blocked_user_agent_regexp = pattern(data["blockedUserAgents"])
 
@@ -142,6 +142,8 @@ module Aikido::Zen
       data["monitoredIPAddresses"]&.each do |ip_list|
         monitored_ip_lists << RuntimeSettings::IPList.from_json(ip_list)
       end
+
+      true
     end
 
     # Construct a regular expression from the non-nil and non-empty string,

data/lib/aikido/zen/scanners/path_traversal_scanner.rb

@@ -45,6 +45,9 @@ module Aikido::Zen
       end
 
       def attack?
+        # We block home-relative path
+        return true if @input.start_with?("~") && @filepath.start_with?(@input)
+
         # Single character are ignored because they don't pose a big threat
         return false if @input.length <= 1
 

data/lib/aikido/zen/scanners/sql_injection_scanner.rb

@@ -54,7 +54,7 @@ module Aikido::Zen
 
       def initialize(query, input, dialect)
         @query = query.downcase
-        @input = input.downcase
+        @input = input.downcase.strip
         @dialect = dialect
       end
 

data/lib/aikido/zen/scanners/stored_ssrf_scanner.rb

@@ -36,7 +36,7 @@ module Aikido::Zen
       def attack?
         return unless @config.stored_ssrf? # Feature flag
 
-        return if @config.imds_allowed_hosts.include?(@hostname)
+        return if @config.imds_allowed_hosts.include?(@hostname.chomp("."))
 
         @addresses.find do |address|
           DANGEROUS_ADDRESSES.any? do |dangerous_address|

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.4.1"
+    VERSION = "1.5.0"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.61"

data/lib/aikido/zen.rb

@@ -10,6 +10,7 @@ require_relative "zen/system_info"
 require_relative "zen/worker"
 require_relative "zen/agent"
 require_relative "zen/api_client"
+require_relative "zen/api_stream"
 require_relative "zen/context"
 require_relative "zen/current_context"
 require_relative "zen/detached_agent"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.4.1
+  version: 1.5.0
 platform: ruby
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-05-29 00:00:00.000000000 Z
+date: 2026-06-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -98,6 +98,7 @@ files:
 - lib/aikido/zen/agent.rb
 - lib/aikido/zen/agent/heartbeats_manager.rb
 - lib/aikido/zen/api_client.rb
+- lib/aikido/zen/api_stream.rb
 - lib/aikido/zen/attack.rb
 - lib/aikido/zen/attack_wave.rb
 - lib/aikido/zen/attack_wave/helpers.rb