一句话：提出首个面向 ArkTS 的上下文敏感指针分析框架 APAK，通过专用堆对象模型与插件架构提升调用图精度。
针对 OpenHarmony 新语言 ArkTS，现有调用图生成方法在支撑数据流分析与漏洞模式检测时精度不足，而传统 JS/TS 分析工具无法解释 ArkUI 组件树语义；其瓶颈在于 TypeScript 动态语言特性的闭包机制与 OpenHarmony 框架 API 的交互模式，导致对象引用关系难以精确追踪、调用图可达性出现断裂。本文提出 APAK——首个面向 ArkTS 的上下文敏感指针分析框架，通过独特的 ArkTS 堆对象模型与高可扩展插件架构应对上述挑战，并保证对未来 OpenHarmony 生态演进的适应性。作者从 OpenHarmony 生态中 1,663 个真实应用构建数据集进行评估，显示 APAK 在有效边覆盖等关键指标上优于 CHA/RTA（较 CHA 降低 7.1%，较 RTA 提升 34.2%），边覆盖提升将误报率从 20% 降至 2%。APAK 已并入 OpenHarmony 官方静态分析框架 ArkAnalyzer。
Current call graph generation methods for ArkTS, a new programming language for OpenHarmony, exhibit precision limitations when supporting advanced static analysis tasks such as data flow analysis and vulnerability pattern detection, while the workflow of traditional JavaScript(JS)/TypeScript(TS) analysis tools fails to interpret ArkUI component tree semantics. The core technical bottleneck originates from the closure mechanisms inherent in TypeScript’s dynamic language features and the interaction patterns involving OpenHarmony’s framework APIs. Existing static analysis tools for ArkTS struggle to achieve effective tracking and precise deduction of object reference relationships, leading to topological fractures in call graph reachability and diminished analysis coverage. This technical limitation fundamentally constrains the implementation of advanced program analysis techniques.Therefore, in this paper, we propose a tool named ArkAnalyzer Pointer Analysis Kit (APAK), the first context-sensitive pointer analysis framework specifically designed for ArkTS. APAK addresses these challenges through a unique ArkTS heap object model and a highly extensible plugin architecture, ensuring future adaptability to the evolving OpenHarmony ecosystem. In the evaluation, we construct a dataset from 1,663 real-world applications in the OpenHarmony ecosystem to evaluate APAK, demonstrating APAK’s superior performance over CHA/RTA approaches in critical metrics including valid edge coverage (e.g., a 7.1% reduction compared to CHA and a 34.2% increase over RTA). The improvement in edge coverage systematically reduces false positive rates from 20% to 2%, enabling future exploration of establishing more complex program analysis tools based on our framework. Our proposed APAK has been merged into the official static analysis framework ArkAnalyzer for OpenHarmony.
DOI 原文 ·
@inproceedings{paperbot9459,
title = {Context-Sensitive Pointer Analysis for ArkTS},
author = {Yizhuo Yang and Lingyun Xu and Mingyi Zhou and Li Li},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00269}
}