Druid javascript security

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-gemini-3-flash-preview/fix-security-bug/druid-javascript-security

Specific guidance for securing JavaScript execution in Apache Druid. Use this when working with JavaScriptDimFilter, JavaScriptExtractionFn, JavaScriptAggregatorFactory, and other JS-enabled components.From its SKILL.md

Install

npx -y skills add cxcscmu/SkillLearnBench --skill druid-javascript-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.4 KB, 245 tokens by cl100k_base, as published. Nobody here has run it

Druid JavaScript Security

Core Components

The following classes are primary targets for JavaScript-based attacks:

JavaScriptDimFilter
JavaScriptExtractionFn
JavaScriptAggregatorFactory
JavaScriptPostAggregator
JavaScriptParseSpec
JavaScriptTieredBrokerSelectorStrategy
JavaScriptWorkerSelectStrategy

Hardening Pattern

Disable Input for Config Injection: Use @JacksonInject(useInput = OptBoolean.FALSE) JavaScriptConfig config in constructors.
Explicit Creator Mode: Use @JsonCreator(mode = JsonCreator.Mode.PROPERTIES) to be explicit about how Jackson should treat the constructor.
Late Validation: Ensure config.isEnabled() is checked right before script compilation or execution.

Example of a Patched Constructor

  @JsonCreator
  public JavaScriptDimFilter(
      @JsonProperty("dimension") String dimension,
      @JsonProperty("function") String function,
      @JsonProperty("extractionFn") @Nullable ExtractionFn extractionFn,
      @JsonProperty("filterTuning") @Nullable FilterTuning filterTuning,
      @JacksonInject(useInput = OptBoolean.FALSE) JavaScriptConfig config
  )

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.