[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KFHATWVRF9X9YVF5PR022F":3,"skill-same:01M6KFHATWVRF9X9YVF5PR022F":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":30,"linkOnly":31,"markdownContent":32,"markdownBody":33,"frontMatter":34,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":38,"repositoryHtmlUrl":39,"repositoryHomepageUrl":40,"ownerHtmlUrl":41,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":42,"install":43,"resources":56},"01M6KFHATWVRF9X9YVF5PR022F","run2_jackson-inject-security",null,"Preventing Jackson @JacksonInject bypass via empty JSON keys by using OptBoolean.FALSE to reject user-supplied input for injected parameters.","cxcscmu\u002FSkillLearnBench","cxcscmu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142838272?v=4","01M6KCQDFQWPDSN0MKZY96MSQP","01M6KCQDM7G70TKJ28NTSQC0RZ",92,"MIT","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb2-self-feedback-claude-opus-4-6\u002Ffix-security-bug\u002Frun2_jackson-inject-security\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29],"security","jackson","jackson inject security","run2 jackson inject security","json","user","empty","false","input","via","keys","for","2026-11-10 10:12:30",false,"---\nname: run2_jackson-inject-security\ndescription: Preventing Jackson @JacksonInject bypass via empty JSON keys by using OptBoolean.FALSE to reject user-supplied input for injected parameters.\n---\n\n# Jackson @JacksonInject Security: Preventing Input Override\n\n## Vulnerability\nJackson's `@JacksonInject` allows server-injected values to be overridden by JSON input. An attacker can use an empty key `\"\"` in the JSON payload to inject a custom object that replaces the server-configured value.\n\n### How the Empty Key Attack Works\nWhen Jackson deserializes a class with `@JacksonInject`:\n1. It first sets the injected value from `InjectableValues`\n2. Then it processes JSON properties, including empty-string keys `\"\"`\n3. The empty key `\"\"` can match the injectable parameter, overriding the server value\n\n### Example Attack Payload\n```json\n{\n  \"type\": \"javascript\",\n  \"dimension\": \"dim\",\n  \"function\": \"function(x){java.lang.Runtime.getRuntime().exec('cmd')}\",\n  \"\": {\"enabled\": true}\n}\n```\n\n## Fix: Use `OptBoolean.FALSE`\n\n### Code Change\n```java\n\u002F\u002F BEFORE (vulnerable):\nimport com.fasterxml.jackson.annotation.JacksonInject;\n\n@JsonCreator\npublic MyClass(@JacksonInject MyConfig config) { ... }\n\n\u002F\u002F AFTER (secure):\nimport com.fasterxml.jackson.annotation.JacksonInject;\nimport com.fasterxml.jackson.annotation.OptBoolean;\n\n@JsonCreator\npublic MyClass(@JacksonInject(useInput = OptBoolean.FALSE) MyConfig config) { ... }\n```\n\n### What `useInput = OptBoolean.FALSE` Does\n- Tells Jackson to NEVER use JSON input for this parameter\n- Only the server-injected value from `InjectableValues` is used\n- Any JSON property (including empty key `\"\"`) attempting to set this parameter is ignored\n\n### Compatibility\n- Requires Jackson 2.9+ (available in Jackson 2.10.2 used by Druid 0.20.0)\n- `com.fasterxml.jackson.annotation.OptBoolean` import required\n\n## Patch Generation Workflow\n```bash\n# 1. Make changes to source files\n# 2. Generate unified diff patch\ncd \u002Froot\u002Fdruid && git diff > \u002Froot\u002Fpatches\u002Ffix.patch\n\n# 3. To apply on clean repo:\ncd \u002Froot\u002Fdruid && git apply \u002Froot\u002Fpatches\u002Ffix.patch\n\n# 4. Build specific module with all dependencies:\nmvn clean package -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true \\\n  -Dforbiddenapis.skip=true -Dspotbugs.skip=true -Danimal.sniffer.skip=true \\\n  -Denforcer.skip=true -Djacoco.skip=true -Ddependency-check.skip=true \\\n  -pl '!web-console' -pl indexing-service -am\n```\n","# Jackson @JacksonInject Security: Preventing Input Override\n\n## Vulnerability\nJackson's `@JacksonInject` allows server-injected values to be overridden by JSON input. An attacker can use an empty key `\"\"` in the JSON payload to inject a custom object that replaces the server-configured value.\n\n### How the Empty Key Attack Works\nWhen Jackson deserializes a class with `@JacksonInject`:\n1. It first sets the injected value from `InjectableValues`\n2. Then it processes JSON properties, including empty-string keys `\"\"`\n3. The empty key `\"\"` can match the injectable parameter, overriding the server value\n\n### Example Attack Payload\n```json\n{\n  \"type\": \"javascript\",\n  \"dimension\": \"dim\",\n  \"function\": \"function(x){java.lang.Runtime.getRuntime().exec('cmd')}\",\n  \"\": {\"enabled\": true}\n}\n```\n\n## Fix: Use `OptBoolean.FALSE`\n\n### Code Change\n```java\n\u002F\u002F BEFORE (vulnerable):\nimport com.fasterxml.jackson.annotation.JacksonInject;\n\n@JsonCreator\npublic MyClass(@JacksonInject MyConfig config) { ... }\n\n\u002F\u002F AFTER (secure):\nimport com.fasterxml.jackson.annotation.JacksonInject;\nimport com.fasterxml.jackson.annotation.OptBoolean;\n\n@JsonCreator\npublic MyClass(@JacksonInject(useInput = OptBoolean.FALSE) MyConfig config) { ... }\n```\n\n### What `useInput = OptBoolean.FALSE` Does\n- Tells Jackson to NEVER use JSON input for this parameter\n- Only the server-injected value from `InjectableValues` is used\n- Any JSON property (including empty key `\"\"`) attempting to set this parameter is ignored\n\n### Compatibility\n- Requires Jackson 2.9+ (available in Jackson 2.10.2 used by Druid 0.20.0)\n- `com.fasterxml.jackson.annotation.OptBoolean` import required\n\n## Patch Generation Workflow\n```bash\n# 1. Make changes to source files\n# 2. Generate unified diff patch\ncd \u002Froot\u002Fdruid && git diff > \u002Froot\u002Fpatches\u002Ffix.patch\n\n# 3. To apply on clean repo:\ncd \u002Froot\u002Fdruid && git apply \u002Froot\u002Fpatches\u002Ffix.patch\n\n# 4. Build specific module with all dependencies:\nmvn clean package -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true \\\n  -Dforbiddenapis.skip=true -Dspotbugs.skip=true -Danimal.sniffer.skip=true \\\n  -Denforcer.skip=true -Djacoco.skip=true -Ddependency-check.skip=true \\\n  -pl '!web-console' -pl indexing-service -am\n```\n",{"name":5,"description":7},"main","726e1f79b96b0cb3d729d0e55a1c847e0b5353ae","skills\u002Fb2-self-feedback-claude-opus-4-6\u002Ffix-security-bug\u002Frun2_jackson-inject-security",7,"https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench","https:\u002F\u002Fcxcscmu.github.io\u002FSkillLearnBench","https:\u002F\u002Fgithub.com\u002Fcxcscmu","2026-10-02 22:55:36",{"source":8,"skillName":5,"commands":44,"prompt":54,"zipAvailable":55},[45,48,51],{"tool":46,"command":47},"npx","npx skills add cxcscmu\u002FSkillLearnBench --skill run2_jackson-inject-security",{"tool":49,"command":50},"bunx","bunx skills add cxcscmu\u002FSkillLearnBench --skill run2_jackson-inject-security",{"tool":52,"command":53},"pnpm","pnpm dlx skills add cxcscmu\u002FSkillLearnBench --skill run2_jackson-inject-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb2-self-feedback-claude-opus-4-6\u002Ffix-security-bug\u002Frun2_jackson-inject-security\u002FSKILL.md",true,[],[58,76,99,117,136,148],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":69,"publishedAt":30},"01M6KM5KH175P5ABP5JMX2SBDQ","object_counter","Count occurrences of an object in the image using computer vision algorithm.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Fvideo-object-counting\u002Fobject_counter\u002FSKILL.md",[64],{"categoryNo":65,"categoryName":66,"taxonomyType":67,"taxonomyTypeDesc":68},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[70,71,72,73,74,75],"object counter","object","vision","computer","Computer Vision","image",{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":85,"publishedAt":30},"01M6KM51TMVXG79MMPCS6Y8G86","travel-planning-workflow","Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Ftravel-planning-workflow\u002FSKILL.md",[82],{"categoryNo":83,"categoryName":84,"taxonomyType":67,"taxonomyTypeDesc":68},"01JBSEEDCAT000000000000023","Skill与智能体开发",[86,87,88,89,90,91,92,93,94,29,23,95,96,97,98],"workflow","planning","planning workflow","travel","travel planning","travel planning workflow","structured","performing","plan","it","requirements","essential","itineraries",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":30},"01M6KM4DY820XHS9YTSK5QP5HD","bundled-dataset-search-tool","invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Fbundled-dataset-search-tool\u002FSKILL.md",[],[106,107,108,109,110,111,112,89,113,114,90,115,29,116,87],"search","tool","dataset","bundled dataset search tool","restaurants","Tools","up","look","flights","you","database",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":30},"01M6KM465BB9PQ0B548HQSVAWZ","glm-output","Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final \u002Froot\u002Fmetrics.json.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-output\u002FSKILL.md",[],[124,125,126,29,127,128,22,129,130,131,132,133,115,134,135],"glm output","output","glm","tasks","metrics","basics","guidance","matching","verifier","processing","root","calibration",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":30},"01M6KM40KY3QWDW5W97S39R2BC","glm-calibration","Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-calibration\u002FSKILL.md",[142],{"categoryNo":83,"categoryName":84,"taxonomyType":67,"taxonomyTypeDesc":68},[144,135,126,125,130,129,127,145,146,29,147],"glm calibration","setup","companion","metric",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":30},"01M6KM3VHHVSGMGHJQB3PPT6YG","glm-basics","A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-basics\u002FSKILL.md",[],[155,126,129,156,144,135,29,125,157,158,159,160,161,162,127],"glm basics","inspect","relevant","files","good","use","how","Evaluation"]