[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KGRPB29YK87EEFTFPEZKCM":3,"skill-same:01M6KGRPB29YK87EEFTFPEZKCM":62},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":35,"linkOnly":36,"markdownContent":37,"markdownBody":38,"frontMatter":39,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":43,"repositoryHtmlUrl":44,"repositoryHomepageUrl":45,"ownerHtmlUrl":46,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":47,"install":48,"resources":61},"01M6KGRPB29YK87EEFTFPEZKCM","Locate Jackson Deserialization Entry Points in Druid",null,"Find the exact code locations where user-supplied JSON is deserialized into DimFilter and other security-sensitive objects in Apache Druid's indexing pipeline, to identify where raw input validation must occur before Jackson processes it.","cxcscmu\u002FSkillLearnBench","cxcscmu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142838272?v=4","01M6KCQDFQWPDSN0MKZY96MSQP","01M6KCQDM7G70TKJ28NTSQC0RZ",93,"MIT","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb3-teacher-feedback-claude-haiku-4-5\u002Ffix-security-bug\u002Frun3_Locate-Jackson-Deserialization-Entry-Points-in-Druid\u002FSKILL.md",[],[5,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34],"locate","deserialization","jackson","objects","Input Validation","it","processes","input","indexing","security","user","find","json","pipeline","apache","validation","code","2026-11-10 10:12:30",false,"---\nname: Locate Jackson Deserialization Entry Points in Druid\ndescription: Find the exact code locations where user-supplied JSON is deserialized into DimFilter and other security-sensitive objects in Apache Druid's indexing pipeline, to identify where raw input validation must occur before Jackson processes it.\n---\n\n# Locating Jackson Deserialization Entry Points\n\n## Search Strategy\n\n1. **Find Filter Deserialization**\n   - Search for `readValue.*DimFilter` across the codebase\n   - Search for `objectMapper.readValue` in indexing-service module\n   - Search for `transformSpec` parsing and filter extraction\n   - Look in `DruidInputSource`, `InputSourceSampler`, and `SamplerResource`\n\n2. **Trace the Request Path**\n   - The exploit targets `\u002Fdruid\u002Findexer\u002Fv1\u002Fsampler` endpoint\n   - Find the corresponding resource handler (likely `SamplerResource.java`)\n   - Trace from HTTP request → JSON parsing → object deserialization\n   - Identify where `spec.dataSchema.transformSpec.filter` is deserialized\n\n3. **Identify the ObjectMapper Configuration**\n   - Find the ObjectMapper instance used for this deserialization\n   - Check if it has custom deserializers registered\n   - Locate the default deserialization behavior for filters\n\n## Expected Findings\n\nThe vulnerable flow should look similar to:\n```java\n\u002F\u002F Somewhere in SamplerResource or InputSourceSampler\nString jsonInput = request.getBody();  \u002F\u002F Raw JSON from attacker\nObjectMapper mapper = new ObjectMapper();\nDataSchema schema = mapper.readValue(jsonInput, DataSchema.class);\n\u002F\u002F At this point, the empty key \"\" has already bypassed security\nDimFilter filter = schema.getTransformSpec().getFilter();\n```\n\n## Key Files to Examine\n\n- `druid-indexing-service\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Findexing\u002Foverlord\u002Fsampler\u002FSamplerResource.java`\n- `druid-indexing-service\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Findexing\u002Foverlord\u002Fsampler\u002FInputSourceSampler.java`\n- `druid-core\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fsegment\u002Ftransform\u002FTransformSpec.java`\n- `druid-core\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fquery\u002Ffilter\u002FDimFilter.java`\n\n## Validation Approach\n\nOnce the entry point is found, the fix must:\n1. **Validate raw JSON string** before passing to `ObjectMapper.readValue()`\n2. **Reject empty keys** `\"\"` at the input stream level\n3. **Prevent bypass of JavaScript security** via malformed JSON structures","# Locating Jackson Deserialization Entry Points\n\n## Search Strategy\n\n1. **Find Filter Deserialization**\n   - Search for `readValue.*DimFilter` across the codebase\n   - Search for `objectMapper.readValue` in indexing-service module\n   - Search for `transformSpec` parsing and filter extraction\n   - Look in `DruidInputSource`, `InputSourceSampler`, and `SamplerResource`\n\n2. **Trace the Request Path**\n   - The exploit targets `\u002Fdruid\u002Findexer\u002Fv1\u002Fsampler` endpoint\n   - Find the corresponding resource handler (likely `SamplerResource.java`)\n   - Trace from HTTP request → JSON parsing → object deserialization\n   - Identify where `spec.dataSchema.transformSpec.filter` is deserialized\n\n3. **Identify the ObjectMapper Configuration**\n   - Find the ObjectMapper instance used for this deserialization\n   - Check if it has custom deserializers registered\n   - Locate the default deserialization behavior for filters\n\n## Expected Findings\n\nThe vulnerable flow should look similar to:\n```java\n\u002F\u002F Somewhere in SamplerResource or InputSourceSampler\nString jsonInput = request.getBody();  \u002F\u002F Raw JSON from attacker\nObjectMapper mapper = new ObjectMapper();\nDataSchema schema = mapper.readValue(jsonInput, DataSchema.class);\n\u002F\u002F At this point, the empty key \"\" has already bypassed security\nDimFilter filter = schema.getTransformSpec().getFilter();\n```\n\n## Key Files to Examine\n\n- `druid-indexing-service\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Findexing\u002Foverlord\u002Fsampler\u002FSamplerResource.java`\n- `druid-indexing-service\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Findexing\u002Foverlord\u002Fsampler\u002FInputSourceSampler.java`\n- `druid-core\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fsegment\u002Ftransform\u002FTransformSpec.java`\n- `druid-core\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fquery\u002Ffilter\u002FDimFilter.java`\n\n## Validation Approach\n\nOnce the entry point is found, the fix must:\n1. **Validate raw JSON string** before passing to `ObjectMapper.readValue()`\n2. **Reject empty keys** `\"\"` at the input stream level\n3. **Prevent bypass of JavaScript security** via malformed JSON structures",{"name":5,"description":7},"main","726e1f79b96b0cb3d729d0e55a1c847e0b5353ae","skills\u002Fb3-teacher-feedback-claude-haiku-4-5\u002Ffix-security-bug\u002Frun3_Locate-Jackson-Deserialization-Entry-Points-in-Druid",8,"https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench","https:\u002F\u002Fcxcscmu.github.io\u002FSkillLearnBench","https:\u002F\u002Fgithub.com\u002Fcxcscmu","2026-10-02 22:55:36",{"source":8,"skillName":5,"commands":49,"prompt":59,"zipAvailable":60},[50,53,56],{"tool":51,"command":52},"npx","npx skills add cxcscmu\u002FSkillLearnBench --skill \"Locate Jackson Deserialization Entry Points in Druid\"",{"tool":54,"command":55},"bunx","bunx skills add cxcscmu\u002FSkillLearnBench --skill \"Locate Jackson Deserialization Entry Points in Druid\"",{"tool":57,"command":58},"pnpm","pnpm dlx skills add cxcscmu\u002FSkillLearnBench --skill \"Locate Jackson Deserialization Entry Points in Druid\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb3-teacher-feedback-claude-haiku-4-5\u002Ffix-security-bug\u002Frun3_Locate-Jackson-Deserialization-Entry-Points-in-Druid\u002FSKILL.md",true,[],[63,81,104,122,141,153],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":74,"publishedAt":35},"01M6KM5KH175P5ABP5JMX2SBDQ","object_counter","Count occurrences of an object in the image using computer vision algorithm.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Fvideo-object-counting\u002Fobject_counter\u002FSKILL.md",[69],{"categoryNo":70,"categoryName":71,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[75,76,77,78,79,80],"object counter","object","vision","computer","Computer Vision","image",{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":90,"publishedAt":35},"01M6KM51TMVXG79MMPCS6Y8G86","travel-planning-workflow","Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Ftravel-planning-workflow\u002FSKILL.md",[87],{"categoryNo":88,"categoryName":89,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000023","Skill与智能体开发",[91,92,93,94,95,96,97,98,99,100,28,23,101,102,103],"workflow","planning","planning workflow","travel","travel planning","travel planning workflow","structured","performing","plan","for","requirements","essential","itineraries",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":35},"01M6KM4DY820XHS9YTSK5QP5HD","bundled-dataset-search-tool","invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Fbundled-dataset-search-tool\u002FSKILL.md",[],[111,112,113,114,115,116,117,94,118,119,95,120,100,121,92],"search","tool","dataset","bundled dataset search tool","restaurants","Tools","up","look","flights","you","database",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":35},"01M6KM465BB9PQ0B548HQSVAWZ","glm-output","Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final \u002Froot\u002Fmetrics.json.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-output\u002FSKILL.md",[],[129,130,131,100,132,133,30,134,135,136,137,138,120,139,140],"glm output","output","glm","tasks","metrics","basics","guidance","matching","verifier","processing","root","calibration",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":148,"publishedAt":35},"01M6KM40KY3QWDW5W97S39R2BC","glm-calibration","Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-calibration\u002FSKILL.md",[147],{"categoryNo":88,"categoryName":89,"taxonomyType":72,"taxonomyTypeDesc":73},[149,140,131,130,135,134,132,150,151,100,152],"glm calibration","setup","companion","metric",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":159,"publishedAt":35},"01M6KM3VHHVSGMGHJQB3PPT6YG","glm-basics","A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-basics\u002FSKILL.md",[],[160,131,134,161,149,140,100,130,162,163,164,165,166,167,132],"glm basics","inspect","relevant","files","good","use","how","Evaluation"]