Run3 druid jackson parameter mapping fix

Analyze Constructor Annotations: Examine the @JsonCreator constructors of JavaScript-related classes. Locate the JavaScriptConfig parameter.

Identify the Bypass Mechanism: The vulnerability exists because Jackson may map unexpected JSON keys (like the empty string "") to object properties if the mapping is ambiguous. If a JavaScriptConfig parameter is present in a constructor but not strictly bound to a specific property or is incorrectly handled by @JacksonInject, a malicious payload can provide its own "enabled: true" configuration.

Apply Explicit Injection: To fix the mapping, ensure the JavaScriptConfig parameter is purely injected and not mapped from JSON properties.

• Use @JacksonInject without a corresponding @JsonProperty for the config parameter.
• If @JsonProperty is present on the config parameter, remove it or ensure it does not conflict with the system injection.
• Example of a secure pattern:

  @JsonCreator
  public JavaScriptDimFilter(
      @JsonProperty("dimension") String dimension,
      @JsonProperty("function") String function,
      ...
      @JacksonInject JavaScriptConfig config // No @JsonProperty here
  )
  

Audit for Hidden Overrides: Check if the class has a setter for JavaScriptConfig or a public field that Jackson might automatically discover. These must be removed or annotated with @JsonIgnore.