jackson-druid-cve
Security and Jackson deserialization issues in Apache Druid, focusing on property bypasses.
- License 许可
- MIT
- 最近更新
- 2026-10-02
- Stars
- ★ 93
- Forks
- 7
01 前言 Front Matter
- name
- jackson-druid-cve
- description
- Security and Jackson deserialization issues in Apache Druid, focusing on property bypasses.
03 SKILL.md 正文
Jackson Deserialization Security in Druid
When dealing with Jackson, unknown properties or empty properties can sometimes be mapped to configuration objects or bypass validation if @JsonCreator is not carefully constrained. This can lead to security vulnerabilities.
In Apache Druid, configuration classes like JavaScriptConfig are often passed via dependency injection or default constructors, and mapped from JSON if not disabled.
Techniques
- Restricting JSON properties using
@JsonIgnoreProperties - Throwing exceptions on unknown properties
- Ensuring that
@JacksonInjector required properties cannot be overridden by user input like"".
04 同仓库更多 Skills
object_counter
Count occurrences of an object in the image using computer vision algorithm.
travel-planning-workflow
Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.
bundled-dataset-search-tool
invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.
glm-output
Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final /root/metrics.json.
glm-calibration
Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.
glm-basics
A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.