Java javascript security
[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.
npx -y skills add cxcscmu/SkillLearnBench --skill java-javascript-securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Best practices for securing JavaScript execution in Java applications using ScriptEngines like Rhino or Nashorn.
SKILL.md
1.6 KB, 294 tokens by cl100k_base, as published. Nobody here has run it
Java JavaScript Security
When executing JavaScript in a Java application, it is crucial to restrict the capabilities of the script to prevent Arbitrary Code Execution (ACE).
Vulnerability: Access to Java Classes
By default, many JavaScript engines (like Rhino, which Druid uses) allow the script to access Java classes.
var Runtime = java.lang.Runtime;
Runtime.getRuntime().exec("rm -rf /");
Mitigation: Disabling JavaScript if not needed
The best defense is to disable JavaScript execution entirely if it is not required. Apache Druid provides a configuration druid.javascript.enabled to control this.
Mitigation: Sandboxing
If JavaScript must be used, it should be sandboxed.
Rhino Sandboxing
In Rhino, you can use a ClassShutter to restrict which Java classes the script can access.
Context cx = Context.enter();
try {
cx.setClassShutter(new ClassShutter() {
@Override
public boolean visibleToScripts(String fullClassName) {
return fullClassName.startsWith("org.mycompany.safe.");
}
});
// ...
} finally {
Context.exit();
}
Mitigation: Input Validation
Always validate the JSON structure and ensure that security-critical configurations (like whether JS is enabled) cannot be overridden by user input. In Druid, this often involves ensuring @JacksonInject values are not overridable by JSON properties.