agentsclimarketplace
Sign in

Jackson druid cve

Skill cxcscmu/SkillLearnBench/skills/b1-one-shot-gemini-3.1-pro-preview/fix-security-bug/jackson-druid-cve

Security and Jackson deserialization issues in Apache Druid, focusing on property bypasses.From its SKILL.md

Install
npx -y skills add cxcscmu/SkillLearnBench --skill jackson-druid-cve

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

0.8 KB, 121 tokens by cl100k_base, as published. Nobody here has run it

Jackson Deserialization Security in Druid

When dealing with Jackson, unknown properties or empty properties can sometimes be mapped to configuration objects or bypass validation if @JsonCreator is not carefully constrained. This can lead to security vulnerabilities.

In Apache Druid, configuration classes like JavaScriptConfig are often passed via dependency injection or default constructors, and mapped from JSON if not disabled.

Techniques

  • Restricting JSON properties using @JsonIgnoreProperties
  • Throwing exceptions on unknown properties
  • Ensuring that @JacksonInject or required properties cannot be overridden by user input like "".

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.