agentsclimarketplace
Sign in

Druid vulnerability fix

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-gemini-3.1-flash-lite-preview/fix-security-bug/druid-vulnerability-fix

How to fix the Apache Druid JavaScript sampler vulnerability. Use this skill when patching Druid code to block arbitrary JavaScript execution.From its SKILL.md

Install
npx -y skills add cxcscmu/SkillLearnBench --skill druid-vulnerability-fix

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.2 KB, 203 tokens by cl100k_base, as published. Nobody here has run it

Druid JavaScript Sampler Vulnerability Fix

Overview

The vulnerability allows authenticated users to execute arbitrary code via the /druid/indexer/v1/sampler endpoint by passing a malicious JavaScript payload with an empty key "" in the JSON spec.

Fixing Strategy

  1. Identify the affected component: The JavaScriptConfig or related validation logic in Druid's processing module is responsible for the JavaScript filter.
  2. Restrict access: Ensure that the JavaScript filter is properly guarded and cannot be bypassed by empty keys or other malformed JSON structures.
  3. Validate payload: Add strict validation to the sampler configuration that prevents arbitrary code injection via the function property.

Patching Workflow

  1. Locate the responsible class (likely JavaScriptFilter or JavaScriptConfig).
  2. Implement robust input sanitization and validation.
  3. Generate a diff/patch file in /root/patches/.
  4. Apply the patch to /root/druid/.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.