[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KDM7T4RVVSDH2HT0CQ5XNR":3,"skill-same:01M6KDM7T4RVVSDH2HT0CQ5XNR":55},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":28,"linkOnly":29,"markdownContent":30,"markdownBody":31,"frontMatter":32,"refName":33,"commitSha":34,"skillDirectory":35,"forksCount":36,"repositoryHtmlUrl":37,"repositoryHomepageUrl":38,"ownerHtmlUrl":39,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":40,"install":41,"resources":54},"01M6KDM7T4RVVSDH2HT0CQ5XNR","jackson-inject-security",null,"Preventing Jackson @JacksonInject override attacks where JSON input can replace server-side injected values.","cxcscmu\u002FSkillLearnBench","cxcscmu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142838272?v=4","01M6KCQDFQWPDSN0MKZY96MSQP","01M6KCQDM7G70TKJ28NTSQC0RZ",93,"MIT","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb1-one-shot-claude-opus-4-6\u002Ffix-security-bug\u002Fjackson-inject-security\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27],"security","jackson","jackson inject security","server","json","server-side","input","attacks","can","values","2026-11-10 10:12:30",false,"---\nname: jackson-inject-security\ndescription: Preventing Jackson @JacksonInject override attacks where JSON input can replace server-side injected values.\n---\n\n# Jackson @JacksonInject Security\n\n## The Vulnerability\n\nWhen using `@JacksonInject` in Jackson `@JsonCreator` constructors, JSON input can override server-side injected values by default. This happens because `@JacksonInject` defaults to `useInput = OptBoolean.DEFAULT`, which allows JSON properties to take precedence over injected values.\n\n## Attack Mechanism\n\nIf a class has:\n```java\n@JsonCreator\npublic MyClass(@JacksonInject MyConfig config) { ... }\n```\n\nAn attacker can send JSON with `\"\": {\"enabled\": true}` to override the injected `config` value. The empty string key `\"\"` maps to inject parameters that have no explicit ID.\n\nCombined with `FAIL_ON_UNKNOWN_PROPERTIES = false` (common in many frameworks), the attack payload passes silently.\n\n## Fix: useInput = OptBoolean.FALSE\n\nJackson 2.9+ introduced `OptBoolean` for `@JacksonInject`:\n\n```java\nimport com.fasterxml.jackson.annotation.OptBoolean;\n\n@JsonCreator\npublic MyClass(\n    @JacksonInject(useInput = OptBoolean.FALSE) MyConfig config\n) { ... }\n```\n\nThis prevents JSON input from overriding the injected value entirely.\n\n## Additional Defense: Constructor Validation\n\nAdd validation in the constructor to check the config before storing it:\n\n```java\n@JsonCreator\npublic MyClass(\n    @JacksonInject(useInput = OptBoolean.FALSE) MyConfig config\n) {\n    Preconditions.checkState(config.isEnabled(), \"Feature is disabled\");\n    this.config = config;\n}\n```\n\n## Jackson Version Compatibility\n\n- `OptBoolean.FALSE` for `@JacksonInject(useInput=...)` requires Jackson 2.9+\n- Check with: `\u003Cjackson.version>` in `pom.xml`\n","# Jackson @JacksonInject Security\n\n## The Vulnerability\n\nWhen using `@JacksonInject` in Jackson `@JsonCreator` constructors, JSON input can override server-side injected values by default. This happens because `@JacksonInject` defaults to `useInput = OptBoolean.DEFAULT`, which allows JSON properties to take precedence over injected values.\n\n## Attack Mechanism\n\nIf a class has:\n```java\n@JsonCreator\npublic MyClass(@JacksonInject MyConfig config) { ... }\n```\n\nAn attacker can send JSON with `\"\": {\"enabled\": true}` to override the injected `config` value. The empty string key `\"\"` maps to inject parameters that have no explicit ID.\n\nCombined with `FAIL_ON_UNKNOWN_PROPERTIES = false` (common in many frameworks), the attack payload passes silently.\n\n## Fix: useInput = OptBoolean.FALSE\n\nJackson 2.9+ introduced `OptBoolean` for `@JacksonInject`:\n\n```java\nimport com.fasterxml.jackson.annotation.OptBoolean;\n\n@JsonCreator\npublic MyClass(\n    @JacksonInject(useInput = OptBoolean.FALSE) MyConfig config\n) { ... }\n```\n\nThis prevents JSON input from overriding the injected value entirely.\n\n## Additional Defense: Constructor Validation\n\nAdd validation in the constructor to check the config before storing it:\n\n```java\n@JsonCreator\npublic MyClass(\n    @JacksonInject(useInput = OptBoolean.FALSE) MyConfig config\n) {\n    Preconditions.checkState(config.isEnabled(), \"Feature is disabled\");\n    this.config = config;\n}\n```\n\n## Jackson Version Compatibility\n\n- `OptBoolean.FALSE` for `@JacksonInject(useInput=...)` requires Jackson 2.9+\n- Check with: `\u003Cjackson.version>` in `pom.xml`\n",{"name":5,"description":7},"main","726e1f79b96b0cb3d729d0e55a1c847e0b5353ae","skills\u002Fb1-one-shot-claude-opus-4-6\u002Ffix-security-bug\u002Fjackson-inject-security",8,"https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench","https:\u002F\u002Fcxcscmu.github.io\u002FSkillLearnBench","https:\u002F\u002Fgithub.com\u002Fcxcscmu","2026-10-02 22:55:36",{"source":8,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add cxcscmu\u002FSkillLearnBench --skill jackson-inject-security",{"tool":47,"command":48},"bunx","bunx skills add cxcscmu\u002FSkillLearnBench --skill jackson-inject-security",{"tool":50,"command":51},"pnpm","pnpm dlx skills add cxcscmu\u002FSkillLearnBench --skill jackson-inject-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb1-one-shot-claude-opus-4-6\u002Ffix-security-bug\u002Fjackson-inject-security\u002FSKILL.md",true,[],[56,74,99,117,136,148],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":67,"publishedAt":28},"01M6KM5KH175P5ABP5JMX2SBDQ","object_counter","Count occurrences of an object in the image using computer vision algorithm.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Fvideo-object-counting\u002Fobject_counter\u002FSKILL.md",[62],{"categoryNo":63,"categoryName":64,"taxonomyType":65,"taxonomyTypeDesc":66},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[68,69,70,71,72,73],"object counter","object","vision","computer","Computer Vision","image",{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":83,"publishedAt":28},"01M6KM51TMVXG79MMPCS6Y8G86","travel-planning-workflow","Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Ftravel-planning-workflow\u002FSKILL.md",[80],{"categoryNo":81,"categoryName":82,"taxonomyType":65,"taxonomyTypeDesc":66},"01JBSEEDCAT000000000000023","Skill与智能体开发",[84,85,86,87,88,89,90,91,92,93,94,95,96,97,98],"workflow","planning","planning workflow","travel","travel planning","travel planning workflow","structured","performing","plan","for","user","it","requirements","essential","itineraries",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":28},"01M6KM4DY820XHS9YTSK5QP5HD","bundled-dataset-search-tool","invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Fbundled-dataset-search-tool\u002FSKILL.md",[],[106,107,108,109,110,111,112,87,113,114,88,115,93,116,85],"search","tool","dataset","bundled dataset search tool","restaurants","Tools","up","look","flights","you","database",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":28},"01M6KM465BB9PQ0B548HQSVAWZ","glm-output","Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final \u002Froot\u002Fmetrics.json.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-output\u002FSKILL.md",[],[124,125,126,93,127,128,22,129,130,131,132,133,115,134,135],"glm output","output","glm","tasks","metrics","basics","guidance","matching","verifier","processing","root","calibration",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":28},"01M6KM40KY3QWDW5W97S39R2BC","glm-calibration","Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-calibration\u002FSKILL.md",[142],{"categoryNo":81,"categoryName":82,"taxonomyType":65,"taxonomyTypeDesc":66},[144,135,126,125,130,129,127,145,146,93,147],"glm calibration","setup","companion","metric",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":28},"01M6KM3VHHVSGMGHJQB3PPT6YG","glm-basics","A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-basics\u002FSKILL.md",[],[155,126,129,156,144,135,93,125,157,158,159,160,161,162,127],"glm basics","inspect","relevant","files","good","use","how","Evaluation"]