java-route-tracer

Java Web source-code routing multi-level call-chain tracing tool. Given a user-specified route path, it traces the complete call chain from Controller/Action to the DAO layer and outputs each layer's file location, method signature, and possible input parameters. Suitable for parameter-flow analysis for various vulnerability types: (1) SQL injection - trace parameters to SQL concatenation points, (2) command injection - trace parameters to Runtime.exec(), (3) SSRF - trace parameters to HTTP requests, (4) XSS - trace parameters to response output, (5) file operations - trace parameters to File operations, (6) XXE/deserialization/LDAP injection/expression injection, etc. Supports frameworks such as Spring MVC, Struts 2, Servlet, JAX-RS. **Supports decompiling .class/.jar files to extract call chains**. Can be combined with java-route-mapper to achieve complete route + call-chain auditing.