ArkAnalyzer: The Static Analysis Framework for OpenHarmony

TL;DR

The paper addresses the lack of static analysis support for ArkTS within the OpenHarmony ecosystem and presents ArkAnalyzer, a dedicated static analysis framework tailored to ArkTS. It introduces an ArkTS-specific AST-based code representation, a readable intermediate representation, two code transformation pathways (three-address code and desugaring), and augmentation via def-use chains and type inference, along with CHA and RTA for call graphs. Comprehensive evaluation on a large ArkTS app dataset demonstrates high efficiency (sub-second scene construction, sub-10-second analysis for large apps) and strong accuracy, with practical analyzers for sensitive API scanning and null-pointer detection, and qualitative IR readability feedback. The work provides an open-source ArkTS dataset and a framework that can be extended to build robust OpenHarmony app analyzers, laying the groundwork for ongoing improvements and broader ecosystem tooling.

Abstract

ArkTS is a new programming language dedicated to developing apps for the emerging OpenHarmony mobile operating system. Like other programming languages constantly suffering from performance-related code smells or vulnerabilities, the ArkTS programming language will likely encounter the same problems. The solution given by our research community is to invent static analyzers, which are often implemented on top of a common static analysis framework, to detect and subsequently repair those issues automatically. Unfortunately, such an essential framework is not available for the OpenHarmony community yet. Existing program analysis methods have several problems when handling the ArkTS code. To bridge the gap, we design and implement a framework named ArkAnalyzer and make it publicly available as an open-source project. Our ArkAnalyzer addresses the aforementioned problems and has already integrated a number of fundamental static analysis functions that are ready to be reused by developers to implement OpenHarmony

Figures (8)

• Figure 1: Existing JS/TS Analysis Tools Inapplicable to ArkTS
• Figure 2: ArkUI Code Example.
• Figure 3: Overview of the Design of ArkAnalyzer.
• Figure 4: The design of the core classes designed for representing code under analysis.
• Figure 5: The design of the ArkMethod class.