Run3 Create and Apply Git Patch Files for Druid Security Fixes
[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.
npx -y skills add cxcscmu/SkillLearnBench --skill run3_Create-and-Apply-Git-Patch-Files-for-Druid-Security-FixesAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Generate proper git-compatible patch files that address the empty key validation and JavaScript filter disabling vulnerabilities, then apply them to the Druid 0.20.0 source repository.
SKILL.md
3.0 KB, as published. Nobody here has run it
Creating and Applying Security Patch Files
Patch File Structure
Each patch must be a valid git diff that can be applied with git apply or patch command.
Patch 1: Input Validation for Empty Keys
File: /root/patches/001-validate-empty-keys.patch
Content format:
diff --git a/path/to/file.java b/path/to/file.java
index <old-hash>..<new-hash> 100644
--- a/path/to/file.java
+++ b/path/to/file.java
@@ <line-number>,<count> +<line-number>,<count> @@
existing context line
-removed line
+added line
existing context line
Targets:
- The resource handler that receives
/druid/indexer/v1/samplerPOST requests - Inject validation before
ObjectMapper.readValue()is called - Add utility method to recursively check for empty keys in JSON
Patch 2: Disable JavaScript Filters
File: /root/patches/002-disable-javascript-filters.patch
Content format:
- Modify the filter factory or deserializer to reject
"type": "javascript" - Add configuration property default
druid.javascript.enabled=false - Modify module initialization to conditionally register JavaScript filter
Patch 3: Add Validation Utility Class (if needed)
File: /root/patches/003-add-json-validator.patch
Content format:
- New file addition in patch format
- Utility class for recursive JSON validation
- Used by Patch 1
Application Process
# Navigate to Druid repository
cd /root/druid
# Apply patches in order
git apply /root/patches/001-validate-empty-keys.patch
git apply /root/patches/002-disable-javascript-filters.patch
git apply /root/patches/003-add-json-validator.patch
# Verify patches applied
git status
git diff HEAD~3
Patch Creation from Working Code
If developing new code:
cd /root/druid
# Start with clean state
git checkout <file>
# Make security modifications to file
# (add validation code, etc.)
# Generate patch
git diff <file> > /root/patches/001-validate-empty-keys.patch
# Or with more context
git diff -U5 <file> > /root/patches/001-validate-empty-keys.patch
Validation Rules for Patches
Each patch file must:
- Be valid unified diff format
- Apply cleanly without merge conflicts (
git apply --check) - Target specific files in the indexing-service module
- Include adequate context lines (usually 3 lines before/after changes)
- Have clear, descriptive headers
Testing Patch Application
# Before applying
cd /root/druid
git apply --check /root/patches/001-validate-empty-keys.patch
# Apply
git apply /root/patches/001-validate-empty-keys.patch
# Verify build
mvn clean package -DskipTests -Dcheckstyle.skip=true \
-Dpmd.skip=true -Dforbiddenapis.skip=true -Dspotbugs.skip=true \
-Danimal.sniffer.skip=true -Denforcer.skip=true -Djacoco.skip=true \
-Ddependency-check.skip=true -pl '!web-console' -pl indexing-service -am