Run3 druid javascript vulnerability locator

Systematic identification of all Apache Druid components utilizing JavaScript to ensure comprehensive patching of CVE-2021-25646.From its SKILL.md

Install

npx -y skills add cxcscmu/SkillLearnBench --skill run3_druid-javascript-vulnerability-locator

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.5 KB, 295 tokens by cl100k_base, as published. Nobody here has run it

Search for JavaScript Config Consumers: Identify all classes that depend on JavaScriptConfig. Use grep or an IDE to find usages of the JavaScriptConfig class, specifically looking for constructor parameters or fields annotated with @JacksonInject.
Required Class List: Ensure the following classes (at minimum) are inspected for JavaScript execution logic and configuration injection:
- Filters: org.apache.druid.query.filter.JavaScriptDimFilter
- Aggregators: org.apache.druid.query.aggregation.JavaScriptAggregatorFactory
- Post-Aggregators: org.apache.druid.query.aggregation.post.JavaScriptPostAggregator
- Extraction Functions: org.apache.druid.query.extraction.JavaScriptExtractionFn
- Search Query Specs: org.apache.druid.query.search.JavaScriptSearchQuerySpec
- Broker Selection: org.apache.druid.server.router.JavaScriptTieredBrokerSelectorStrategy
- Worker Selectors: org.apache.druid.indexing.overlord.setup.JavaScriptWorkerSelectStrategy
Validation of Input Sources: For each identified class, verify if the JavaScriptConfig object is being passed via the constructor and if that constructor is annotated with @JsonCreator. If a parameter is meant to be injected by the system but lacks explicit protection, it may be susceptible to JSON-based overrides.

Read from the repository

Just SKILL.md. No reference files, no scripts.