# Scheduled Task Security Detection Module

> Security detection rules based on RuoYi scheduled task arbitrary file write vulnerability
> Targeting reflection-based execution security risks in task scheduling systems

## Risk Pattern Library

### Risk Pattern 1: Scheduled Task Reflection Execution of Arbitrary Methods (High Risk)

#### Vulnerable Code Example
```java
// ❌ High Risk: Reflection execution vulnerability in ScheduleRunnable
public class ScheduleRunnable implements Runnable {
    public ScheduleRunnable(String beanName, String methodName, String params) {
        this.target = SpringContextUtil.getBean(beanName);  // ❌ User-controllable Bean
        this.method = target.getClass().getDeclaredMethod(methodName, String.class);  // ❌ User-controllable method
    }

    public void run() {
        method.invoke(target, params);  // ❌ Arbitrary method execution
    }
}

// ❌ High Risk: Scheduled task management interface
@PostMapping("/monitor/job/add")
public AjaxResult addSave(SysJob job) {
    return toAjax(jobService.insertJobCron(job));  // ❌ No security validation
}
```

#### Attack Vector
```json
{
    "jobName": "ruoYiConfig.setProfile",
    "invokeTarget": "ruoYiConfig.setProfile('C://windows/win.ini')",
    "jobGroup": "DEFAULT",
    "cronExpression": "0/10 * * * * ?",
    "status": "1"
}
```

### Risk Pattern 2: Insufficient Permission Control for Scheduled Task Management (Medium Risk)

#### Vulnerable Code Example
```java
// ❌ Medium Risk: Insufficient permission control
@RequiresPermissions("monitor:job:add")  // ❌ Permission granularity too coarse
@PostMapping("/monitor/job/add")
public AjaxResult addSave(SysJob job) {
    // Missing business logic permission validation
    return toAjax(jobService.insertJobCron(job));
}
```

### Risk Pattern 3: Missing Parameter Validation for Scheduled Tasks (High Risk)

#### Vulnerable Code Example
```java
// ❌ High Risk: No security validation for parameters
public ScheduleRunnable(String beanName, String methodName, String params) {
    // Missing parameter security checks
    this.target = SpringContextUtil.getBean(beanName);
    this.params = params;  // ❌ Direct use of user input
    this.method = target.getClass().getDeclaredMethod(methodName, String.class);
}
```

## Detection Command Set

### Scheduled Task Interface Detection
```bash
# 1. Scheduled task management interface detection
grep -rn "@.*Mapping.*/monitor/job" --include="*.java"

# 2. Scheduled task business logic detection
grep -rn "ScheduleRunnable\|QuartzJobBean" --include="*.java"

# 3. Reflection invocation context detection
grep -rn "SpringContextUtil\\.getBean" --include="*.java" -B 5 -A 5

# 4. Scheduled task service detection
grep -rn "ISysJobService\|SysJobServiceImpl" --include="*.java"

# 5. Scheduled task entity detection
grep -rn "class SysJob" --include="*.java" -A 20
```

### Additional Detection Commands (Based on RuoYi Deep Audit Experience)
```bash
# 6. Reflection method invocation detection (High Risk)
grep -rn "method\\.invoke" --include="*.java" -B 10 -A 5

# 7. Scheduled task immediate execution interface detection
grep -rn "@PostMapping.*run" --include="*.java" -B 5 -A 5

# 8. Method parameter control detection
grep -rn "getMethodParams\\|methodParams" --include="*.java" -B 5 -A 5

# 9. Scheduled task call chain complete analysis
grep -rn "ScheduleUtils\\.run" --include="*.java" -B 5 -A 5

# 10. Multi-layer call chain tracing
grep -rn "SysJobController\\.run" --include="*.java" -A 20 | grep -E "jobService|ScheduleUtils"
```

### Combined Detection Patterns (New Rules)
```bash
# 11. High-risk combined detection: Scheduled task interface + reflection invocation
Detection conditions:
- Exists: @PostMapping("/monitor/job/*")
- Exists: method.invoke(target, params)
- Exists: user-controllable methodParams

Risk Level: 🔴 High (Remote Code Execution)

# 12. Permission context combined detection
Detection conditions:
- Exists: @RequiresPermissions("monitor:job:*")
- Exists: dangerous reflection invocation
- Missing method whitelist validation

Risk Level: 🔴 High (Permission Bypass + RCE)
```

## Security Remediation Solutions

### Remediation 1: Method Invocation Whitelist Validation

```java
// ✅ Secure: Method invocation whitelist validation
public ScheduleRunnable(String beanName, String methodName, String params) {
    // Whitelist validation
    if (!isAllowedMethod(beanName, methodName)) {
        throw new SecurityException("Method not allowed: " + beanName + "." + methodName);
    }

    this.target = SpringContextUtil.getBean(beanName);
    this.params = params;

    if (StringUtils.isNotEmpty(params)) {
        this.method = target.getClass().getDeclaredMethod(methodName, String.class);
    } else {
        this.method = target.getClass().getDeclaredMethod(methodName);
    }
}

private boolean isAllowedMethod(String beanName, String methodName) {
    // Whitelist configuration
    return ALLOWED_METHODS.contains(beanName + "." + methodName);
}
```

### Remediation 2: Parameter Content Security Validation

```java
// ✅ Secure: Parameter content security check
public ScheduleRunnable(String beanName, String methodName, String params) {
    // Parameter security check
    if (StringUtils.isNotEmpty(params) && !isSafeParams(params)) {
        throw new SecurityException("Unsafe parameters detected");
    }

    this.target = SpringContextUtil.getBean(beanName);
    this.params = params;

    if (StringUtils.isNotEmpty(params)) {
        this.method = target.getClass().getDeclaredMethod(methodName, String.class);
    } else {
        this.method = target.getClass().getDeclaredMethod(methodName);
    }
}

private boolean isSafeParams(String params) {
    // Prohibit dangerous characters and path traversal
    return !params.matches(".*[./\\\\\.\$\{\}].*");
}
```

### Remediation 3: Business Logic Permission Enhancement

```java
// ✅ Secure: Business logic permission validation
@RequiresPermissions("monitor:job:add")
@PostMapping("/monitor/job/add")
public AjaxResult addSave(SysJob job) {
    // Business logic permission validation
    if (!hasJobCreationPermission(job)) {
        return error("No permission to create this job");
    }

    // Parameter security validation
    if (!isValidJobConfiguration(job)) {
        return error("Invalid job configuration");
    }

    return toAjax(jobService.insertJobCron(job));
}

private boolean hasJobCreationPermission(SysJob job) {
    // Fine-grained permission control
    return SecurityUtils.getSubject().isPermitted("job:create:" + job.getJobGroup());
}
```

## Risk Rating Matrix

| Risk Type | Severity | Exploitation Difficulty | Detection Difficulty | Fix Priority |
|-----------|----------|------------------------|---------------------|--------------|
| Scheduled task reflection execution | 🔴 High | Low | Medium | Fix Immediately |
| Missing method invocation whitelist | 🔴 High | Low | Medium | Fix Immediately |
| Missing parameter validation | 🔴 High | Low | Medium | Fix Immediately |
| Insufficient permission control | 🟡 Medium | Medium | Low | Plan Fix |

## Security Best Practices

1. **Method Whitelist**: Establish a strict method invocation whitelist mechanism
2. **Parameter Validation**: Perform strict content validation on all user input
3. **Permission Control**: Implement fine-grained business logic permission control
4. **Audit Logging**: Record all scheduled task creation and execution operations
5. **Resource Limits**: Restrict scheduled task execution frequency and resource usage

## Detection Priority

### High-Risk Detection Items (Execute Immediately)
- [ ] Scheduled task reflection execution vulnerability detection
- [ ] Method invocation whitelist validation missing
- [ ] Parameter content security validation missing

### Medium-Risk Detection Items (Planned Execution)
- [ ] Scheduled task permission control insufficient
- [ ] Business logic permission validation missing
- [ ] Execution log records incomplete

Through the detection rules of this module, security risks in scheduled task scheduling systems can be effectively identified, especially critical vulnerabilities related to reflection execution.
