SQL Queries - CAST Knowledge Base - Queries on objects - How to List the Calling and Called Objects

Purpose of Query

These queries provide a list of objects calling another object or being called by another objects. This output can be useful in metrics such as fan-in (calling objects) or fan-out (called objects).

In other words, if routine A calls routine B then routine A is the caller and routine B is the callee. i.e. the caller is the routine which is calling the callee.  

Routine A is the calling object and routine B is the called object.


Applicable CAST Version
Release
Yes/No
8.3.x(tick)
8.2.x(tick)
Applicable RDBMS
RDBMS
Yes/No
Oracle Server(question)
Microsoft SQL Server(question)
CSS(tick)
Query for CSS

Calling Objects

For the query below, please provide a search string for the calling object(s) (CALLING_OBJECT in the query below):

SELECT *
FROM   OBJFULNAM
WHERE  IDOBJ IN
       ( SELECT IDCLR
       FROM    ACC
       WHERE   IDCLE IN
               (SELECT IDOBJ
               FROM    OBJFULNAM
               WHERE   fullname LIKE '%CALLING_OBJECT%'
               )
       );
Query result example
 

3230;"org.owasp.webgoat.lessons.WsSqlInjection.getDefaultCategory"
3491;"org.owasp.webgoat.lessons.SoapRequest.getDefaultCategory"
3266;"org.owasp.webgoat.lessons.WsSAXInjection.getDefaultCategory"
4014;"org.owasp.webgoat.lessons.Category.{(90:2)}"
3328;"org.owasp.webgoat.lessons.WSDLScanning.getDefaultCategory"

Query result interpretation
 The output provides the local base object id and the object full name of the objects that are calling the CALLING_OBJECT.


Called Objects

For the query below, please provide a search string for the called object(s) (CALLED_OBJECT in the query below):


SELECT *
FROM   OBJFULNAM
WHERE  IDOBJ IN
       ( SELECT IDCLE
       FROM    ACC
       WHERE   IDCLR IN
               (SELECT IDOBJ
               FROM    OBJFULNAM
               WHERE   fullname LIKE '%CALLED_OBJECT%'
               )
       );
Query result example

4474;"org.owasp.webgoat.lessons.Category.ERROR_HANDLING"

4472;"org.owasp.webgoat.lessons.Category.INSECURE_COMMUNICATION"

3307;"org.owasp.webgoat.lessons.WeakAuthenticationCookie.getDefaultCategory"

4491;"org.owasp.webgoat.lessons.CSRF.getDefaultCategory"


Query result interpretation
 The output provides the local base object id and the object full name of the objects that are called by the CALLED_OBJECT.
Query for Oracle
Enter the SQL query
Query result example

Query result interpretation

Query for SQL server
Enter the SQL query
Query result example

Query result interpretation

Notes/comments



Related Pages