[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KG1FZ6C8DX8K2DWSJN1XCC":3,"skill-same:01M6KG1FZ6C8DX8K2DWSJN1XCC":52},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":25,"linkOnly":26,"markdownContent":27,"markdownBody":28,"frontMatter":29,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":33,"repositoryHtmlUrl":34,"repositoryHomepageUrl":35,"ownerHtmlUrl":36,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":37,"install":38,"resources":51},"01M6KG1FZ6C8DX8K2DWSJN1XCC","run2_jackson-empty-key-vulnerability",null,"Detailed explanation of the Jackson empty key (\"\") vulnerability and how it bypasses @JacksonInject security.","cxcscmu\u002FSkillLearnBench","cxcscmu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142838272?v=4","01M6KCQDFQWPDSN0MKZY96MSQP","01M6KCQDM7G70TKJ28NTSQC0RZ",93,"MIT","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb2-self-feedback-gemini-3-flash-preview\u002Ffix-security-bug\u002Frun2_jackson-empty-key-vulnerability\u002FSKILL.md",[],[18,19,20,21,22,23,24],"vulnerability","empty","jackson","run2 jackson empty key vulnerability","security","how","it","2026-11-10 10:12:30",false,"---\nname: run2_jackson-empty-key-vulnerability\ndescription: Detailed explanation of the Jackson empty key (\"\") vulnerability and how it bypasses @JacksonInject security.\n---\n\n# Jackson Empty Key (\"\") Vulnerability\n\nThe vulnerability (e.g., CVE-2021-25646 in Apache Druid) occurs when Jackson's `@JacksonInject` is used to provide sensitive configuration objects, but the deserialization process allows these objects to be overridden by malicious JSON input.\n\n## How it works\n1. **Unnamed Injected Parameters**: If a constructor parameter is marked with `@JacksonInject` but lacks a `@JsonProperty` name, Jackson may default to matching it against certain JSON keys, including the empty string key `\"\"`.\n2. **Override Behavior**: By default, Jackson might allow the JSON input to populate the fields of an injected object if a match is found.\n3. **Security Bypass**: In Druid, `JavaScriptConfig` is injected to determine if JavaScript is enabled. An attacker can provide `\"\": {\"enabled\": true}` in the JSON, which Jackson uses to override the server-side `JavaScriptConfig` object, thus enabling JavaScript execution for that specific request even if it's globally disabled.\n\n## The Fix: `useInput = OptBoolean.FALSE`\nThe robust fix is to explicitly tell Jackson NOT to use any JSON input for the injected parameter.\n\n```java\n@JsonCreator\npublic MyObject(\n    @JsonProperty(\"someField\") String someField,\n    @JacksonInject(useInput = OptBoolean.FALSE) MyConfig config\n)\n```\n\nSetting `useInput = OptBoolean.FALSE` ensures that the `config` object is ONLY sourced from the `InjectableValues` (server configuration) and never from the JSON payload.\n","# Jackson Empty Key (\"\") Vulnerability\n\nThe vulnerability (e.g., CVE-2021-25646 in Apache Druid) occurs when Jackson's `@JacksonInject` is used to provide sensitive configuration objects, but the deserialization process allows these objects to be overridden by malicious JSON input.\n\n## How it works\n1. **Unnamed Injected Parameters**: If a constructor parameter is marked with `@JacksonInject` but lacks a `@JsonProperty` name, Jackson may default to matching it against certain JSON keys, including the empty string key `\"\"`.\n2. **Override Behavior**: By default, Jackson might allow the JSON input to populate the fields of an injected object if a match is found.\n3. **Security Bypass**: In Druid, `JavaScriptConfig` is injected to determine if JavaScript is enabled. An attacker can provide `\"\": {\"enabled\": true}` in the JSON, which Jackson uses to override the server-side `JavaScriptConfig` object, thus enabling JavaScript execution for that specific request even if it's globally disabled.\n\n## The Fix: `useInput = OptBoolean.FALSE`\nThe robust fix is to explicitly tell Jackson NOT to use any JSON input for the injected parameter.\n\n```java\n@JsonCreator\npublic MyObject(\n    @JsonProperty(\"someField\") String someField,\n    @JacksonInject(useInput = OptBoolean.FALSE) MyConfig config\n)\n```\n\nSetting `useInput = OptBoolean.FALSE` ensures that the `config` object is ONLY sourced from the `InjectableValues` (server configuration) and never from the JSON payload.\n",{"name":5,"description":7},"main","726e1f79b96b0cb3d729d0e55a1c847e0b5353ae","skills\u002Fb2-self-feedback-gemini-3-flash-preview\u002Ffix-security-bug\u002Frun2_jackson-empty-key-vulnerability",7,"https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench","https:\u002F\u002Fcxcscmu.github.io\u002FSkillLearnBench","https:\u002F\u002Fgithub.com\u002Fcxcscmu","2026-10-02 22:55:36",{"source":8,"skillName":5,"commands":39,"prompt":49,"zipAvailable":50},[40,43,46],{"tool":41,"command":42},"npx","npx skills add cxcscmu\u002FSkillLearnBench --skill run2_jackson-empty-key-vulnerability",{"tool":44,"command":45},"bunx","bunx skills add cxcscmu\u002FSkillLearnBench --skill run2_jackson-empty-key-vulnerability",{"tool":47,"command":48},"pnpm","pnpm dlx skills add cxcscmu\u002FSkillLearnBench --skill run2_jackson-empty-key-vulnerability","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb2-self-feedback-gemini-3-flash-preview\u002Ffix-security-bug\u002Frun2_jackson-empty-key-vulnerability\u002FSKILL.md",true,[],[53,71,95,113,133,145],{"skillNo":54,"name":55,"nameZh":6,"description":56,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":57,"categories":58,"keywords":64,"publishedAt":25},"01M6KM5KH175P5ABP5JMX2SBDQ","object_counter","Count occurrences of an object in the image using computer vision algorithm.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Fvideo-object-counting\u002Fobject_counter\u002FSKILL.md",[59],{"categoryNo":60,"categoryName":61,"taxonomyType":62,"taxonomyTypeDesc":63},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[65,66,67,68,69,70],"object counter","object","vision","computer","Computer Vision","image",{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":80,"publishedAt":25},"01M6KM51TMVXG79MMPCS6Y8G86","travel-planning-workflow","Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Ftravel-planning-workflow\u002FSKILL.md",[77],{"categoryNo":78,"categoryName":79,"taxonomyType":62,"taxonomyTypeDesc":63},"01JBSEEDCAT000000000000023","Skill与智能体开发",[81,82,83,84,85,86,87,88,89,90,91,24,92,93,94],"workflow","planning","planning workflow","travel","travel planning","travel planning workflow","structured","performing","plan","for","user","requirements","essential","itineraries",{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":25},"01M6KM4DY820XHS9YTSK5QP5HD","bundled-dataset-search-tool","invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Fbundled-dataset-search-tool\u002FSKILL.md",[],[102,103,104,105,106,107,108,84,109,110,85,111,90,112,82],"search","tool","dataset","bundled dataset search tool","restaurants","Tools","up","look","flights","you","database",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":25},"01M6KM465BB9PQ0B548HQSVAWZ","glm-output","Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final \u002Froot\u002Fmetrics.json.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-output\u002FSKILL.md",[],[120,121,122,90,123,124,125,126,127,128,129,130,111,131,132],"glm output","output","glm","tasks","metrics","json","basics","guidance","matching","verifier","processing","root","calibration",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":25},"01M6KM40KY3QWDW5W97S39R2BC","glm-calibration","Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-calibration\u002FSKILL.md",[139],{"categoryNo":78,"categoryName":79,"taxonomyType":62,"taxonomyTypeDesc":63},[141,132,122,121,127,126,123,142,143,90,144],"glm calibration","setup","companion","metric",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":25},"01M6KM3VHHVSGMGHJQB3PPT6YG","glm-basics","A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-basics\u002FSKILL.md",[],[152,122,126,153,141,132,90,121,154,155,156,157,23,158,123],"glm basics","inspect","relevant","files","good","use","Evaluation"]