[OSS26] 追踪方法上游调用链 trace_call_chain_upstream_by_method_name

接口介绍

从一个目标方法出发,反向追溯所有可能到达它的调用链(多层、多分支),直到遇到入口方法(如 Spring Controller)或达到深度上限;返回链路上每一跳的方法、行号、入口标识。

工具名

trace_call_chain_upstream_by_method_name

背景与目标

单层 caller 查找只看一层。在安全审计中,我们经常需要从一个 sink 一路反推到 HTTP 入口:

• Statement.execute(sql) ← UserDao.search ← UserService.find ← UserController.search(用户可达)
• 这条链揭示了"用户输入 → 危险操作"的完整路径

这是 YASA 跨仓审计的核心入口。本任务先做单仓库版,跨仓由后续工具补足。

输入参数

输出结构

{
  "target_method": "com.example.dao.UserDao.executeRawSql",
  "total_chains": 3,
  "max_depth_reached": 4,
  "chains": [
    {
      "chain_id": 1,
      "depth": 4,
      "entry_point": {
        "method_full_name": "com.example.controller.SearchController.search",
        "entry_kind": "controller",
        "http_route": "GET /search"
      },
      "path": [
        {"method_full_name": "com.example.controller.SearchController.search", "line": 32, "calls_next_at_line": 36},
        {"method_full_name": "com.example.service.SearchService.run", "line": 18, "calls_next_at_line": 24},
        {"method_full_name": "com.example.dao.UserDao.search", "line": 55, "calls_next_at_line": 58},
        {"method_full_name": "com.example.dao.UserDao.executeRawSql", "line": 102, "calls_next_at_line": null}
      ]
    }
  ],
  "truncated": false
}

验收标准

• 正确反向遍历调用图直到 entry 类(Controller 等)或达到 max_depth
• 同一方法在不同链中按不同 path 返回,链与链独立去重(但不丢失分支)
• entry_kind 至少识别 Spring @Controller/@RestController/@RequestMapping(可扩展)
• 检测循环调用并标记 truncated_reason: "cycle"
• 单元测试覆盖:多链分支、循环、超出 max_depth、未找到上游
• 中等仓库响应 < 20s

预估工作量

10-14 人日(团队协作:调用图持久化 + 反向 BFS + entry 识别)

Start by locating the entry point and registration for trace_call_chain_upstream_by_method_name, then inspect how the repository represents and traverses its call graph. Use the acceptance criteria to define tests for branching chains, cycles, depth limits, and missing upstream callers. Done means the specified output structure and Spring entry recognition work within the stated limits.