druid-javascript-vulnerability-locator

name	druid-javascript-vulnerability-locator
description	Systematic identification of all Apache Druid components utilizing JavaScript to ensure comprehensive patching of CVE-2021-25646.

1. Search for JavaScript Config Consumers: Identify all classes that depend on JavaScriptConfig. Use grep or an IDE to find usages of the JavaScriptConfig class, specifically looking for constructor parameters or fields annotated with @JacksonInject.

2. Required Class List: Ensure the following classes (at minimum) are inspected for JavaScript execution logic and configuration injection:

   • Filters: org.apache.druid.query.filter.JavaScriptDimFilter
   • Aggregators: org.apache.druid.query.aggregation.JavaScriptAggregatorFactory
   • Post-Aggregators: org.apache.druid.query.aggregation.post.JavaScriptPostAggregator
   • Extraction Functions: org.apache.druid.query.extraction.JavaScriptExtractionFn
   • Search Query Specs: org.apache.druid.query.search.JavaScriptSearchQuerySpec
   • Broker Selection: org.apache.druid.server.router.JavaScriptTieredBrokerSelectorStrategy
   • Worker Selectors: org.apache.druid.indexing.overlord.setup.JavaScriptWorkerSelectStrategy

3. Validation of Input Sources: For each identified class, verify if the JavaScriptConfig object is being passed via the constructor and if that constructor is annotated with @JsonCreator. If a parameter is meant to be injected by the system but lacks explicit protection, it may be susceptible to JSON-based overrides.