[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KGRDRJC3SSM9MHFA9TT7VH":3,"skill-same:01M6KGRDRJC3SSM9MHFA9TT7VH":61},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":39,"commitSha":40,"skillDirectory":41,"forksCount":42,"repositoryHtmlUrl":43,"repositoryHomepageUrl":44,"ownerHtmlUrl":45,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":46,"install":47,"resources":60},"01M6KGRDRJC3SSM9MHFA9TT7VH","Disable JavaScript Execution in Druid Filters",null,"Configure and enforce a security policy that completely disables JavaScript filter evaluation in Apache Druid, preventing arbitrary code execution through the javascript filter type even if structural validation is bypassed.","cxcscmu\u002FSkillLearnBench","cxcscmu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142838272?v=4","01M6KCQDFQWPDSN0MKZY96MSQP","01M6KCQDM7G70TKJ28NTSQC0RZ",93,"MIT","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb3-teacher-feedback-claude-haiku-4-5\u002Ffix-security-bug\u002Frun3_Disable-JavaScript-Execution-in-Druid-Filters\u002FSKILL.md",[],[5,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33],"javascript","execution","filters","configure","security policy","code execution","filter","type","structural","enforce","security","Evaluation","apache","validation","code","policy","2026-11-10 10:12:30",false,"---\nname: Disable JavaScript Execution in Druid Filters\ndescription: Configure and enforce a security policy that completely disables JavaScript filter evaluation in Apache Druid, preventing arbitrary code execution through the javascript filter type even if structural validation is bypassed.\n---\n\n# Disabling JavaScript Filter Execution\n\n## Problem\nEven if empty key validation is in place, the `\"type\": \"javascript\"` filter capability itself is a code execution vector. The security sandbox can be disabled or bypassed.\n\n## Solution: Disable JavaScript Filters at Configuration Level\n\n### Implementation Strategy\n\n1. **Identify JavaScript Filter Registration**\n   - Find `JavaScriptDimFilter` class and its factory registration\n   - Locate where filter types are registered (likely in a filter registry or module)\n   - Find where JavaScript evaluation is initialized\n\n2. **Create Security Configuration**\n   - Add a Druid configuration property to disable JavaScript filters\n   - Default to **disabled** (secure-by-default)\n   - Prevent re-enabling via ObjectMapper annotations or runtime configuration\n\n3. **Enforcement Approach**\n\n   **Option A: Remove from Filter Registry**\n   - Unregister `JavaScriptDimFilter` from the factory\n   - During module initialization, skip registration of JavaScript filter type\n   - Returns 400 Bad Request if client attempts to use it\n\n   **Option B: Reject at Deserialization**\n   - Create a custom deserializer for filter JSON\n   - If `type == \"javascript\"`, throw `JsonMappingException` immediately\n   - Prevents any JavaScript filter from being instantiated\n\n4. **Configuration Property**\n   ```\n   druid.javascript.enabled=false  (default, required for security)\n   ```\n\n### Code Pattern\n\n```java\n\u002F\u002F In filter factory or deserializer\nif (\"javascript\".equals(filterType)) {\n    if (!isJavaScriptEnabled()) {\n        throw new IllegalArgumentException(\n            \"JavaScript filters are disabled. \" +\n            \"Set druid.javascript.enabled=true to enable (not recommended).\"\n        );\n    }\n}\n\nprivate static boolean isJavaScriptEnabled() {\n    \u002F\u002F Check configuration, default false\n    return config.getBoolean(\"druid.javascript.enabled\", false);\n}\n```\n\n### Defense in Depth\n\n- Even if an attacker bypasses empty key validation, they cannot execute JavaScript\n- JavaScript evaluation engine should not be initialized if disabled\n- Configuration should be immutable once the server starts","# Disabling JavaScript Filter Execution\n\n## Problem\nEven if empty key validation is in place, the `\"type\": \"javascript\"` filter capability itself is a code execution vector. The security sandbox can be disabled or bypassed.\n\n## Solution: Disable JavaScript Filters at Configuration Level\n\n### Implementation Strategy\n\n1. **Identify JavaScript Filter Registration**\n   - Find `JavaScriptDimFilter` class and its factory registration\n   - Locate where filter types are registered (likely in a filter registry or module)\n   - Find where JavaScript evaluation is initialized\n\n2. **Create Security Configuration**\n   - Add a Druid configuration property to disable JavaScript filters\n   - Default to **disabled** (secure-by-default)\n   - Prevent re-enabling via ObjectMapper annotations or runtime configuration\n\n3. **Enforcement Approach**\n\n   **Option A: Remove from Filter Registry**\n   - Unregister `JavaScriptDimFilter` from the factory\n   - During module initialization, skip registration of JavaScript filter type\n   - Returns 400 Bad Request if client attempts to use it\n\n   **Option B: Reject at Deserialization**\n   - Create a custom deserializer for filter JSON\n   - If `type == \"javascript\"`, throw `JsonMappingException` immediately\n   - Prevents any JavaScript filter from being instantiated\n\n4. **Configuration Property**\n   ```\n   druid.javascript.enabled=false  (default, required for security)\n   ```\n\n### Code Pattern\n\n```java\n\u002F\u002F In filter factory or deserializer\nif (\"javascript\".equals(filterType)) {\n    if (!isJavaScriptEnabled()) {\n        throw new IllegalArgumentException(\n            \"JavaScript filters are disabled. \" +\n            \"Set druid.javascript.enabled=true to enable (not recommended).\"\n        );\n    }\n}\n\nprivate static boolean isJavaScriptEnabled() {\n    \u002F\u002F Check configuration, default false\n    return config.getBoolean(\"druid.javascript.enabled\", false);\n}\n```\n\n### Defense in Depth\n\n- Even if an attacker bypasses empty key validation, they cannot execute JavaScript\n- JavaScript evaluation engine should not be initialized if disabled\n- Configuration should be immutable once the server starts",{"name":5,"description":7},"main","726e1f79b96b0cb3d729d0e55a1c847e0b5353ae","skills\u002Fb3-teacher-feedback-claude-haiku-4-5\u002Ffix-security-bug\u002Frun3_Disable-JavaScript-Execution-in-Druid-Filters",8,"https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench","https:\u002F\u002Fcxcscmu.github.io\u002FSkillLearnBench","https:\u002F\u002Fgithub.com\u002Fcxcscmu","2026-10-02 22:55:36",{"source":8,"skillName":5,"commands":48,"prompt":58,"zipAvailable":59},[49,52,55],{"tool":50,"command":51},"npx","npx skills add cxcscmu\u002FSkillLearnBench --skill \"Disable JavaScript Execution in Druid Filters\"",{"tool":53,"command":54},"bunx","bunx skills add cxcscmu\u002FSkillLearnBench --skill \"Disable JavaScript Execution in Druid Filters\"",{"tool":56,"command":57},"pnpm","pnpm dlx skills add cxcscmu\u002FSkillLearnBench --skill \"Disable JavaScript Execution in Druid Filters\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb3-teacher-feedback-claude-haiku-4-5\u002Ffix-security-bug\u002Frun3_Disable-JavaScript-Execution-in-Druid-Filters\u002FSKILL.md",true,[],[62,80,105,123,143,155],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":73,"publishedAt":34},"01M6KM5KH175P5ABP5JMX2SBDQ","object_counter","Count occurrences of an object in the image using computer vision algorithm.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Fvideo-object-counting\u002Fobject_counter\u002FSKILL.md",[68],{"categoryNo":69,"categoryName":70,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[74,75,76,77,78,79],"object counter","object","vision","computer","Computer Vision","image",{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":89,"publishedAt":34},"01M6KM51TMVXG79MMPCS6Y8G86","travel-planning-workflow","Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Ftravel-planning-workflow\u002FSKILL.md",[86],{"categoryNo":87,"categoryName":88,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000023","Skill与智能体开发",[90,91,92,93,94,95,96,97,98,99,100,101,102,103,104],"workflow","planning","planning workflow","travel","travel planning","travel planning workflow","structured","performing","plan","for","user","it","requirements","essential","itineraries",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":34},"01M6KM4DY820XHS9YTSK5QP5HD","bundled-dataset-search-tool","invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Fbundled-dataset-search-tool\u002FSKILL.md",[],[112,113,114,115,116,117,118,93,119,120,94,121,99,122,91],"search","tool","dataset","bundled dataset search tool","restaurants","Tools","up","look","flights","you","database",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":34},"01M6KM465BB9PQ0B548HQSVAWZ","glm-output","Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final \u002Froot\u002Fmetrics.json.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-output\u002FSKILL.md",[],[130,131,132,99,133,134,135,136,137,138,139,140,121,141,142],"glm output","output","glm","tasks","metrics","json","basics","guidance","matching","verifier","processing","root","calibration",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":34},"01M6KM40KY3QWDW5W97S39R2BC","glm-calibration","Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-calibration\u002FSKILL.md",[149],{"categoryNo":87,"categoryName":88,"taxonomyType":71,"taxonomyTypeDesc":72},[151,142,132,131,137,136,133,152,153,99,154],"glm calibration","setup","companion","metric",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":34},"01M6KM3VHHVSGMGHJQB3PPT6YG","glm-basics","A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-basics\u002FSKILL.md",[],[162,132,136,163,151,142,99,131,164,165,166,167,168,29,133],"glm basics","inspect","relevant","files","good","use","how"]