Merge branch 'main' into add-outbound-blocking

Author: bitterpanda63

.github/workflows/benchmark.yml

@@ -15,10 +15,13 @@ jobs:
       - name: Start databases
         working-directory:  ./sample-apps/databases
         run: docker compose up --build -d
+
       - name: Set up Python 3.9
         uses: actions/setup-python@v5
         with:
           python-version: 3.9
+      - name: Setup safe-chain
+        run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
 
       - name: Install dependencies
         run: |

.github/workflows/end2end.yml

@@ -58,6 +58,9 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+      - name: Setup safe-chain
+        run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

.github/workflows/lint.yml

@@ -15,6 +15,8 @@ jobs:
       uses: actions/setup-python@v5
       with:
         python-version: '3.13'
+    - name: Setup safe-chain
+      run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
 
     - name: Install dependencies
       run: |

.github/workflows/publish.yml

@@ -18,6 +18,10 @@ jobs:
     - name: Add local.aikido.io to /etc/hosts
       run: |
           sudo echo "127.0.0.1 local.aikido.io" | sudo tee -a /etc/hosts
+
+    - name: Setup safe-chain
+      run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+
     - name: Installation
       run: make dev_install
     - name: Run Pylint

.github/workflows/qa-tests.yml

@@ -27,7 +27,8 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: "3.13"
-
+      - name: Setup safe-chain
+        run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
       - name: Install poetry
         run: pip install poetry
 
@@ -45,9 +46,10 @@ jobs:
           cp firewall-python/.github/workflows/Dockerfile.qa zen-demo-python/Dockerfile
 
       - name: Run Firewall QA Tests
-        uses: AikidoSec/firewall-tester-action@v1.0.0
+        uses: AikidoSec/firewall-tester-action@v1.0.4
         with:
           dockerfile_path: ./zen-demo-python/Dockerfile
           app_port: 8080
-          sleep_before_test: 10
-          skip_tests: test_bypassed_ip_for_geo_blocking,test_demo_apps_generic_tests,test_path_traversal,test_wave_attack
+          sleep_before_test: 30
+          config_update_delay: 100
+          skip_tests: test_bypassed_ip_for_geo_blocking,test_demo_apps_generic_tests,test_path_traversal,test_outbound_domain_blocking,test_bypassed_ip,test_wave_attack,test_block_traffic_by_countries,test_user_rate_limiting_1_minute

.github/workflows/smoke-test-ffi.yml

@@ -38,6 +38,13 @@ jobs:
         if: runner.os == 'Linux'
         run: sudo apt-get install libmysqlclient-dev
 
+      - name: Setup safe-chain (Unix)
+        if: runner.os != 'Windows'
+        run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+      - name: Setup safe-chain (Windows)
+        if: runner.os == 'Windows'
+        run: iex "& { $(iwr 'https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.ps1' -UseBasicParsing) } -ci"
+
       - name: Install dependencies
         run: make install && cp -r .cache/binaries/* aikido_zen/libs
 

.github/workflows/test-publish.yml

@@ -19,6 +19,10 @@ jobs:
     - name: Add local.aikido.io to /etc/hosts
       run: |
           sudo echo "127.0.0.1 local.aikido.io" | sudo tee -a /etc/hosts
+
+    - name: Setup safe-chain
+      run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
+
     - name: Installation
       run: make dev_install
     - name: Run Pylint

.github/workflows/unit-test.yml

@@ -27,10 +27,13 @@ jobs:
       run: |
         cd end2end/server && docker build -t mock_core .
         docker run --name mock_core -d -p 5050:5000 mock_core
+
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
+    - name: Setup safe-chain
+      run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/latest/download/install-safe-chain.sh | sh -s -- --ci
 
     - name: Install dependencies
       run: |

README.md

@@ -22,6 +22,7 @@ Zen will autonomously protect your Python applications from the inside against:
 * 🛡️ [Command injection attacks](https://www.aikido.dev/blog/command-injection-in-2024-unpacked)
 * 🛡️ [Path traversal attacks](https://www.aikido.dev/blog/path-traversal-in-2024-the-year-unpacked)
 * 🛡️ [Server-side request forgery (SSRF)](./docs/ssrf.md)
+* 🛡️ [Attack wave detection](https://help.aikido.dev/zen-firewall/zen-features/attack-wave-protection)
 
 Zen operates autonomously on the same server as your Python app to:
 

aikido_zen/background_process/commands/sync_data_test.py

@@ -93,6 +93,7 @@ def test_process_sync_data_initialization(setup_connection_manager):
     assert connection_manager.statistics.get_record()["requests"] == {
         "aborted": 0,
         "attacksDetected": {"blocked": 0, "total": 5},
+        "attackWaves": {"total": 0, "blocked": 0},
         "total": 10,
         "rateLimited": 0,
     }
@@ -168,6 +169,7 @@ def test_process_sync_data_with_last_updated_at_below_zero(setup_connection_mana
     assert connection_manager.statistics.get_record()["requests"] == {
         "aborted": 0,
         "attacksDetected": {"blocked": 0, "total": 5},
+        "attackWaves": {"total": 0, "blocked": 0},
         "total": 10,
         "rateLimited": 0,
     }
@@ -255,6 +257,7 @@ def test_process_sync_data_existing_route_and_hostnames(setup_connection_manager
     assert connection_manager.statistics.get_record()["requests"] == {
         "aborted": 0,
         "attacksDetected": {"blocked": 0, "total": 10},
+        "attackWaves": {"total": 0, "blocked": 0},
         "total": 20,
         "rateLimited": 0,
     }