{"record":{"id":"47c529df4815537e","repo":"elunez/eladmin","slug":"bean","errorCode":null,"errorMessage":"非法的 Bean，请重新输入！","messagePattern":"非法的 Bean，请重新输入！","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"eladmin-system/src/main/java/me/zhengjie/modules/quartz/rest/QuartzJobController.java","lineNumber":138,"sourceCode":"    public ResponseEntity<Object> executionQuartzJob(@PathVariable Long id){\n        quartzJobService.execution(quartzJobService.findById(id));\n        return new ResponseEntity<>(HttpStatus.NO_CONTENT);\n    }\n\n    @Log(\"删除定时任务\")\n    @ApiOperation(\"删除定时任务\")\n    @DeleteMapping\n    @PreAuthorize(\"@el.check('timing:del')\")\n    public ResponseEntity<Object> deleteQuartzJob(@RequestBody Set<Long> ids){\n        quartzJobService.delete(ids);\n        return new ResponseEntity<>(HttpStatus.OK);\n    }\n\n    private void checkBean(String beanName){\n        // 避免调用攻击者可以从SpringContextHolder获得控制jdbcTemplate类\n        // 并使用getDeclaredMethod调用jdbcTemplate的queryForMap函数，执行任意sql命令。\n        if(!SpringBeanHolder.getAllServiceBeanName().contains(beanName)){\n            throw new BadRequestException(\"非法的 Bean，请重新输入！\");\n        }\n    }\n}\n","sourceCodeStart":120,"sourceCodeEnd":142,"githubUrl":"https://github.com/elunez/eladmin/blob/55fbf705956949697dbd68bf9003776609d3d029/eladmin-system/src/main/java/me/zhengjie/modules/quartz/rest/QuartzJobController.java#L120-L142","documentation":"QuartzJobController.checkBean rejects a quartz job whose beanName is not present in SpringBeanHolder.getAllServiceBeanName() — i.e. not a Spring bean defined with @Service. This is a deliberate security hardening (comments in the code explain it): arbitrary bean names previously allowed invoking beans like jdbcTemplate via reflection and executing arbitrary SQL. Only beans in the service-bean whitelist can be scheduled.","triggerScenarios":"Creating or updating a quartz job with a beanName that is not a registered @Service bean: typo in the name, a bean annotated @Component instead of @Service, a bean in a package not scanned, or an attempted attack using bean names like 'jdbcTemplate'.","commonSituations":"Writing a custom scheduled task class and forgetting @Service; renaming the bean class without updating the job config; plugin/task classes in a module excluded from component scanning; penetration-test payloads targeting the old unvalidated behavior.","solutions":["Ensure the target class is annotated @Service (not @Component/@Configuration) so it lands in the service-bean name list.","Use the exact bean name (default: class simple name with lowercase first letter, e.g. 'visitorTask') in the job form.","Confirm the class's package is under the @SpringBootApplication scan path or explicitly scanned."],"exampleFix":"// before\n@Component(\"myTask\")\npublic class MyTask { public void run(){...} }\n// after\n@Service(\"myTask\")\npublic class MyTask { public void run(){...} }","handlingStrategy":"validation","validationCode":"// before submitting, confirm the bean is a registered service bean\nSet<String> names = SpringBeanHolder.getAllServiceBeanName();\nif (!names.contains(job.getBeanName())) {\n    throw new IllegalArgumentException(\"beanName 必须是 @Service bean: \" + job.getBeanName());\n}","typeGuard":"boolean isServiceBean(String name) {\n    return name != null && SpringBeanHolder.getAllServiceBeanName().contains(name);\n}","tryCatchPattern":null,"preventionTips":["Annotate every schedulable task class with @Service and reference it by that exact bean name.","Offer the valid bean names in the job form dropdown (from /api/quartz/getServiceBeanName-like endpoint) instead of free text.","Never relax this check — it blocks RCE via beans like jdbcTemplate."],"tags":["quartz","spring","security","validation"],"backgroundTag":null,"analyzedSha":"55fbf705956949697dbd68bf9003776609d3d029","analyzedAt":"2026-08-14T11:56:12.758Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}