項(xiàng)目背景

JSAPI實(shí)現(xiàn)不當(dāng)–任意文件上傳function:upload(path,

callsite:upload(file,

C++技術(shù)實(shí)現(xiàn)

DatalogBased

Datalog：帶遞歸的bug（空指針、數(shù)組越界、死循環(huán)

COREF：CallASTASTohos-

函數(shù)內(nèi)數(shù)據(jù)流e.g.if/for/switch/try-catch/param->param->src->代碼數(shù)據(jù)抽取函數(shù)間數(shù)據(jù)流Bottom-Upparamreturnparam->sinksource->return第二階段：按需做top-down/doi/10.1145/3632743OctopusScalingValue-FlowAnalysisviaParallelCollectionofRealizablePathConditions》LLMforBasicblockBasicblockBasicblockBasicblock

bundle代碼中importbundle鴻蒙SDK中APILLMforQwen-2.5-

分支分支BundlebundleapplastgitbuildAstdifflatest單個(gè)引擎無法分析支付寶全量代碼->bundle數(shù)據(jù)摘要->出口節(jié)點(diǎn)：調(diào)用方法/參數(shù)節(jié)點(diǎn)（startAblility/startApp/link節(jié)點(diǎn)：bundlebundle包含跨平臺、跨bundle跨bundle節(jié)點(diǎn)relationkey設(shè)計(jì)–顯式調(diào)用基于relationkeybundleBundle1Bundle2

[filePath]signature#

MFNetcache.SetErrorCallback(t4:(what:number,arg1:number,arg2:number,extra:string)=>void):void;#0Bundle1

跨bundle節(jié)點(diǎn)relationkey設(shè)計(jì)–隱式調(diào)用基于relationkeybundleconstwant:Want=bundleName:bundle2,abilityDelegator.startAbility(want,(err,data)

engine/Bundle2

onCreate(want:Want,launchParam:AbilityConstant.LaunchParam):KeyKey

[bundleName.abilityName]signature1#index->signature2#index[bundle2.testability]startAbility#1->onCreate#1

當(dāng)前完整的知識圖譜sema還包含公司主體、人員、迭