arkanalyzer 1.0.30 → 1.0.32

package/lib/callgraph/pointerAnalysis/PagBuilder.js

@@ -316,7 +316,7 @@ class PagBuilder {
             this.addEdgesFromInterFuncPag(interFuncPag, cid);
         }
         this.addCallsEdgesFromFuncPag(funcPag, cid);
-        this.addDynamicCallSite(funcPag, funcID);
+        this.addDynamicCallSite(funcPag, funcID, cid);
         this.addUnknownCallSite(funcPag, funcID);
         this.handledFunc.add(`${cid}-${funcID}`);
     }
@@ -371,7 +371,7 @@ class PagBuilder {
                 if (ivkExpr instanceof Expr_1.ArkInstanceInvokeExpr) {
                     let baseNode = this.getOrNewPagNode(cid, ivkExpr.getBase());
                     let baseNodeID = baseNode.getID();
-                    this.addThisRefCallEdge(baseNodeID, cid, ivkExpr, callee, calleeCid, cs.callerFuncID);
+                    this.addThisRefCallEdge(baseNodeID, cid, ivkExpr.getBase(), callee, calleeCid, cs.callerFuncID);
                 }
                 else {
                     logger.error(`constructor or intrinsic func is static ${ivkExpr.toString()}`);
@@ -380,130 +380,7 @@ class PagBuilder {
         }
         return true;
     }
-    /**
-     * process Storage API
-     * @returns boolean: check if the cs represent a Storage API, no matter the API will success or fail
-     */
-    processStorage(cs, calleeCGNode, cid) {
-        let storageName = calleeCGNode.getMethod().getDeclaringClassSignature().getClassName();
-        let storageType = this.getStorageType(storageName, cs, cid);
-        // TODO: add other storages
-        if (storageType === Pag_1.StorageType.APP_STORAGE) {
-            let calleeName = calleeCGNode.getMethod().getMethodSubSignature().getMethodName();
-            // TODO: complete AppStorage API
-            if (calleeName === 'setOrCreate') {
-                this.processStorageSetOrCreate(cs, cid);
-            }
-            else if (calleeName === 'link') {
-                this.processStorageLink(cs, cid);
-            }
-            else if (calleeName === 'prop') {
-                this.processStorageProp(cs, cid);
-            }
-            else if (calleeName === 'set') {
-                this.processStorageSet(cs, cid);
-            }
-            else if (calleeName === 'get') {
-                this.processStorageGet(cs, cid);
-            }
-            return true;
-        }
-        else if (storageType === Pag_1.StorageType.LOCAL_STORAGE) {
-            // TODO: LocalStorage is not Static
-        }
-        return false;
-    }
-    processStorageSetOrCreate(cs, cid) {
-        let propertyStr = this.getPropertyName(cs.args[0]);
-        if (!propertyStr) {
-            return;
-        }
-        let propertyName = propertyStr;
-        let propertyNode = this.getOrNewPropertyNode(Pag_1.StorageType.APP_STORAGE, propertyName, cs.callStmt);
-        let storageObj = cs.args[1];
-        this.addPropertyLinkEdge(propertyNode, storageObj, cid, cs.callStmt, Pag_1.StorageLinkEdgeType.Local2Property);
-    }
-    processStorageLink(cs, cid) {
-        let propertyStr = this.getPropertyName(cs.args[0]);
-        if (!propertyStr) {
-            return;
-        }
-        let propertyName = propertyStr;
-        let propertyNode = this.getOrNewPropertyNode(Pag_1.StorageType.APP_STORAGE, propertyName, cs.callStmt);
-        let leftOp = cs.callStmt.getLeftOp();
-        let linkedOpNode = this.pag.getOrNewNode(cid, leftOp);
-        if (linkedOpNode instanceof Pag_1.PagLocalNode) {
-            linkedOpNode.setStorageLink(Pag_1.StorageType.APP_STORAGE, propertyName);
-        }
-        this.pag.addPagEdge(propertyNode, linkedOpNode, Pag_1.PagEdgeKind.Copy);
-        this.pag.addPagEdge(linkedOpNode, propertyNode, Pag_1.PagEdgeKind.Copy);
-    }
-    processStorageProp(cs, cid) {
-        let propertyStr = this.getPropertyName(cs.args[0]);
-        if (!propertyStr) {
-            return;
-        }
-        let propertyName = propertyStr;
-        let propertyNode = this.getOrNewPropertyNode(Pag_1.StorageType.APP_STORAGE, propertyName, cs.callStmt);
-        let leftOp = cs.callStmt.getLeftOp();
-        let linkedOpNode = this.pag.getOrNewNode(cid, leftOp);
-        if (linkedOpNode instanceof Pag_1.PagLocalNode) {
-            linkedOpNode.setStorageLink(Pag_1.StorageType.APP_STORAGE, propertyName);
-        }
-        this.pag.addPagEdge(propertyNode, linkedOpNode, Pag_1.PagEdgeKind.Copy);
-    }
-    processStorageSet(cs, cid) {
-        let ivkExpr = cs.callStmt.getInvokeExpr();
-        if (ivkExpr instanceof Expr_1.ArkInstanceInvokeExpr) {
-            let base = ivkExpr.getBase();
-            let baseNode = this.pag.getOrNewNode(cid, base);
-            if (baseNode.isStorageLinked()) {
-                let argsNode = this.pag.getOrNewNode(cid, cs.args[0]);
-                this.pag.addPagEdge(argsNode, baseNode, Pag_1.PagEdgeKind.Copy);
-            }
-        }
-        else if (ivkExpr instanceof Expr_1.ArkStaticInvokeExpr) {
-            // TODO: process AppStorage.set()
-        }
-    }
-    processStorageGet(cs, cid) {
-        if (!(cs.callStmt instanceof Stmt_1.ArkAssignStmt)) {
-            return;
-        }
-        let leftOp = cs.callStmt.getLeftOp();
-        let ivkExpr = cs.callStmt.getInvokeExpr();
-        let propertyName;
-        if (ivkExpr instanceof Expr_1.ArkStaticInvokeExpr) {
-            let propertyStr = this.getPropertyName(cs.args[0]);
-            if (propertyStr) {
-                propertyName = propertyStr;
-            }
-        }
-        else if (ivkExpr instanceof Expr_1.ArkInstanceInvokeExpr) {
-            let baseNode = this.pag.getOrNewNode(cid, ivkExpr.getBase());
-            if (baseNode.isStorageLinked()) {
-                propertyName = baseNode.getStorage().PropertyName;
-            }
-        }
-        let propertyNode = this.getPropertyNode(Pag_1.StorageType.APP_STORAGE, propertyName, cs.callStmt);
-        if (!propertyNode) {
-            return;
-        }
-        this.pag.addPagEdge(propertyNode, this.pag.getOrNewNode(cid, leftOp, cs.callStmt), Pag_1.PagEdgeKind.Copy, cs.callStmt);
-    }
-    getPropertyName(value) {
-        if (value instanceof Local_1.Local) {
-            let type = value.getType();
-            if (type instanceof Type_1.StringType) {
-                return type.getName();
-            }
-        }
-        else if (value instanceof Constant_1.Constant) {
-            return value.getValue();
-        }
-        return undefined;
-    }
-    addDynamicCallSite(funcPag, funcID) {
+    addDynamicCallSite(funcPag, funcID, cid) {
         // add dyn callsite in funcpag to base node
         for (let cs of funcPag.getDynamicCallSites()) {
             let invokeExpr = cs.callStmt.getInvokeExpr();
@@ -534,6 +411,9 @@ class PagBuilder {
                 }
                 node.addRelatedDynCallSite(cs);
             }
+            if (cs.callStmt instanceof Stmt_1.ArkAssignStmt) {
+                this.getOrNewPagNode(cid, cs.callStmt.getLeftOp(), cs.callStmt);
+            }
         }
     }
     addUnknownCallSite(funcPag, funcID) {
@@ -583,24 +463,29 @@ class PagBuilder {
             // update call graph
             // TODO: movo to cgbuilder
             this.cg.addDynamicCallEdge(callerNode.getID(), dstCGNode.getID(), cs.callStmt);
-            if (!this.cg.detectReachable(dstCGNode.getID(), callerNode.getID())) {
-                let calleeCid = this.ctx.getOrNewContext(cid, dstCGNode.getID(), true);
-                let staticCS = new CallGraph_1.CallSite(cs.callStmt, cs.args, dstCGNode.getID(), cs.callerFuncID);
-                if (this.scale === PointerAnalysisConfig_1.PtaAnalysisScale.MethodLevel) {
-                    srcNodes.push(...this.addStaticPagCallReturnEdge(staticCS, baseClassPTNode, calleeCid));
-                    continue;
-                }
-                srcNodes.push(...this.processContainerPagCallEdge(staticCS, cid, baseClassPTNode));
-                srcNodes.push(...this.addStaticPagCallEdge(staticCS, cid, calleeCid));
-                // Pass base's pts to callee's this pointer
-                if (!dstCGNode.isSdkMethod() && ivkExpr instanceof Expr_1.ArkInstanceInvokeExpr) {
-                    let srcBaseNode = this.addThisRefCallEdge(baseClassPTNode, cid, ivkExpr, callee, calleeCid, cs.callerFuncID);
-                    srcNodes.push(srcBaseNode);
-                }
+            if (this.cg.detectReachable(dstCGNode.getID(), callerNode.getID())) {
+                return srcNodes;
+            }
+            let calleeCid = this.ctx.getOrNewContext(cid, dstCGNode.getID(), true);
+            let staticCS = new CallGraph_1.CallSite(cs.callStmt, cs.args, dstCGNode.getID(), cs.callerFuncID);
+            if (this.scale === PointerAnalysisConfig_1.PtaAnalysisScale.MethodLevel) {
+                srcNodes.push(...this.addStaticPagCallReturnEdge(staticCS, baseClassPTNode, calleeCid));
+                continue;
+            }
+            if ((0, PTAUtils_1.getBuiltInApiType)(ivkExpr === null || ivkExpr === void 0 ? void 0 : ivkExpr.getMethodSignature()) === PTAUtils_1.BuiltApiType.NotBuiltIn) {
+                srcNodes.push(...this.processNormalMethodPagCallEdge(staticCS, cid, calleeCid, baseClassPTNode));
+            }
+            else {
+                // special SDK call: Container API, Function API
+                srcNodes.push(...this.processBuiltInMethodPagCallEdge(staticCS, cid, calleeCid, baseClassPTNode));
             }
         }
         return srcNodes;
     }
+    /**
+     * all possible callee methods of a dynamic call site
+     * handle both PtrInvokeExpr and InstanceInvokeExpr
+     */
     getDynamicCallee(ptNode, value, ivkExpr, cs) {
         let callee = [];
         if (ptNode instanceof Pag_1.PagFuncNode) {
@@ -650,18 +535,143 @@ class PagBuilder {
         }
         return callee;
     }
-    addUpdatedNode(nodeID, diffPT) {
-        var _a;
-        let ptaConfig = PointerAnalysisConfig_1.PointerAnalysisConfig.getInstance();
-        let updatedNode = (_a = this.updatedNodesThisRound.get(nodeID)) !== null && _a !== void 0 ? _a : new ptaConfig.ptsCollectionCtor();
-        updatedNode.union(diffPT);
-        this.updatedNodesThisRound.set(nodeID, updatedNode);
+    processNormalMethodPagCallEdge(staticCS, cid, calleeCid, baseClassPTNode) {
+        let srcNodes = [];
+        let ivkExpr = staticCS.callStmt.getInvokeExpr();
+        let ptNode = this.pag.getNode(baseClassPTNode);
+        let dstCGNode = this.cg.getNode(staticCS.calleeFuncID);
+        let callee = this.cg.getArkMethodByFuncID(staticCS.calleeFuncID);
+        // Dynamic call, Ptr call, normal SDK call
+        srcNodes.push(...this.addStaticPagCallEdge(staticCS, cid, calleeCid, ptNode));
+        // Pass base's pts to callee's this pointer
+        if (!dstCGNode.isSdkMethod() && ivkExpr instanceof Expr_1.ArkInstanceInvokeExpr) {
+            let srcBaseNode = this.addThisRefCallEdge(baseClassPTNode, cid, ivkExpr.getBase(), callee, calleeCid, staticCS.callerFuncID);
+            srcNodes.push(srcBaseNode);
+        }
+        else if (!dstCGNode.isSdkMethod() && ivkExpr instanceof Expr_1.ArkPtrInvokeExpr) {
+            let thisValue = ptNode.getCS().args[0];
+            if (!(thisValue instanceof Local_1.Local)) {
+                return srcNodes;
+            }
+            this.addThisRefCallEdge(baseClassPTNode, ptNode.getOriginCid(), thisValue, callee, calleeCid, staticCS.callerFuncID);
+        }
+        return srcNodes;
     }
-    getUpdatedNodes() {
-        return this.updatedNodesThisRound;
+    /**
+     * include container API, Function API
+     */
+    processBuiltInMethodPagCallEdge(staticCS, cid, calleeCid, baseClassPTNode) {
+        let srcNodes = [];
+        let ivkExpr = staticCS.callStmt.getInvokeExpr();
+        let callee = this.scene.getMethod(ivkExpr.getMethodSignature());
+        let realCallee = this.cg.getArkMethodByFuncID(staticCS.calleeFuncID);
+        if (!callee) {
+            return srcNodes;
+        }
+        let builtInType = (0, PTAUtils_1.getBuiltInApiType)(callee.getSignature());
+        if (builtInType === PTAUtils_1.BuiltApiType.NotBuiltIn || !realCallee) {
+            return srcNodes;
+        }
+        switch (builtInType) {
+            case PTAUtils_1.BuiltApiType.SetAdd:
+            case PTAUtils_1.BuiltApiType.MapSet:
+                this.processContainerPagCallEdge(staticCS, cid, baseClassPTNode, builtInType);
+                break;
+            case PTAUtils_1.BuiltApiType.FunctionCall:
+                /**
+                 * set this and param
+                 * function.call(thisArg, arg1, arg2, ...)
+                 */
+                this.handleFunctionCall(staticCS, cid, calleeCid, realCallee, srcNodes, baseClassPTNode);
+                break;
+            case PTAUtils_1.BuiltApiType.FunctionApply:
+                /**
+                 * set this, resolve array param
+                 * function.apply(thisArg, [argsArray])
+                 */
+                this.handleFunctionApply(staticCS, cid, calleeCid, realCallee, srcNodes, baseClassPTNode);
+                break;
+            case PTAUtils_1.BuiltApiType.FunctionBind:
+                /**
+                 * clone the function node and add the this pointer, origin callsite, args offset to it
+                 * let f = function.bind(thisArg, arg1, arg2, ...)
+                 * f();
+                 */
+                this.handleFunctionBind(staticCS, cid, baseClassPTNode, srcNodes);
+                break;
+        }
+        return srcNodes;
     }
-    resetUpdatedNodes() {
-        this.updatedNodesThisRound.clear();
+    processContainerPagCallEdge(cs, cid, baseClassPTNode, type) {
+        let srcNodes = [];
+        let calleeNode = this.cg.getNode(cs.calleeFuncID);
+        let calleeMethod = this.scene.getMethod(calleeNode.getMethod());
+        let ptNode = this.pag.getNode(baseClassPTNode);
+        if (!calleeMethod || !(ptNode instanceof Pag_1.PagNewContainerExprNode)) {
+            return srcNodes;
+        }
+        let containerValue = cs.callStmt.getInvokeExpr().getBase();
+        const containerValueProcess = (argIndex) => {
+            let srcNode = this.pag.getOrNewNode(cid, cs.args[argIndex], cs.callStmt);
+            let realContainerFieldPagNode = this.pag.getOrClonePagContainerFieldNode(baseClassPTNode, undefined, containerValue);
+            if (realContainerFieldPagNode) {
+                // In some cases, the value of a variable of array type may not be an explicit array object,
+                // and the value of `realContainerFieldPagNode` will be undefined.
+                this.pag.addPagEdge(srcNode, realContainerFieldPagNode, Pag_1.PagEdgeKind.Copy, cs.callStmt);
+                srcNodes.push(srcNode.getID());
+            }
+        };
+        if (type === PTAUtils_1.BuiltApiType.SetAdd) {
+            containerValueProcess(0);
+        }
+        else if (type === PTAUtils_1.BuiltApiType.MapSet) {
+            containerValueProcess(1);
+        }
+        return srcNodes;
+    }
+    handleFunctionCall(staticCS, cid, calleeCid, realCallee, srcNodes, baseClassPTNode) {
+        this.buildFuncPagAndAddToWorklist(new CSFuncID(calleeCid, staticCS.calleeFuncID));
+        srcNodes.push(...this.addCallParamPagEdge(realCallee, staticCS.args, staticCS.callStmt, cid, calleeCid, 1));
+        this.addThisEdge(staticCS, cid, realCallee, srcNodes, baseClassPTNode, calleeCid);
+    }
+    handleFunctionApply(staticCS, cid, calleeCid, realCallee, srcNodes, baseClassPTNode) {
+        this.buildFuncPagAndAddToWorklist(new CSFuncID(calleeCid, staticCS.calleeFuncID));
+        let callerMethod = this.cg.getArkMethodByFuncID(staticCS.callerFuncID);
+        if (!callerMethod) {
+            throw new Error('Cannot get caller method');
+        }
+        let argsRealValues = this.transferArrayValues(callerMethod, staticCS.args[1]);
+        srcNodes.push(...this.addCallParamPagEdge(realCallee, argsRealValues, staticCS.callStmt, cid, calleeCid, 0));
+        this.addThisEdge(staticCS, cid, realCallee, srcNodes, baseClassPTNode, calleeCid);
+    }
+    handleFunctionBind(staticCS, cid, baseClassPTNode, srcNodes) {
+        let srcNode = this.pag.getOrClonePagFuncNode(baseClassPTNode);
+        if (!srcNode) {
+            return;
+        }
+        this.setFunctionThisPt(staticCS, srcNode, cid);
+        let dstNode = this.getOrNewPagNode(cid, staticCS.callStmt.getLeftOp());
+        this.pag.addPagEdge(srcNode, dstNode, Pag_1.PagEdgeKind.Copy, staticCS.callStmt);
+        srcNodes.push(srcNode.getID());
+        srcNode.setCS(staticCS);
+        srcNode.setArgsOffset(1);
+        srcNode.setOriginCid(cid);
+    }
+    addThisEdge(staticCS, cid, realCallee, srcNodes, baseClassPTNode, calleeCid) {
+        if (!(staticCS.args[0] instanceof Constant_1.NullConstant) && !(realCallee.isStatic())) {
+            srcNodes.push(this.addThisRefCallEdge(baseClassPTNode, cid, staticCS.args[0], realCallee, calleeCid, staticCS.callerFuncID));
+        }
+    }
+    setFunctionThisPt(staticCS, srcNode, cid) {
+        let thisLocal = staticCS.args[0];
+        if (!(thisLocal instanceof Local_1.Local)) {
+            return;
+        }
+        let thisInstanceLocal = this.getRealThisLocal(thisLocal, staticCS.callerFuncID);
+        let baseThisNode = this.pag.getOrNewNode(cid, thisInstanceLocal);
+        for (let pt of baseThisNode.getPointTo()) {
+            srcNode.setThisPt(pt);
+        }
     }
     handleUnkownDynamicCall(cs, cid) {
         var _a;
@@ -744,22 +754,10 @@ class PagBuilder {
         }
         return reAnalyzeNodes;
     }
-    addThisRefCallEdge(baseClassPTNode, cid, ivkExpr, callee, calleeCid, callerFunID) {
-        var _a;
-        if (!callee || !callee.getCfg()) {
-            logger.error(`callee is null`);
-            return -1;
-        }
-        let thisAssignStmt = (_a = callee.getCfg()) === null || _a === void 0 ? void 0 : _a.getStmts().filter(s => s instanceof Stmt_1.ArkAssignStmt && s.getRightOp() instanceof Ref_1.ArkThisRef);
-        let thisPtr = (thisAssignStmt === null || thisAssignStmt === void 0 ? void 0 : thisAssignStmt.at(0)).getRightOp();
-        if (!thisPtr) {
-            throw new Error('Can not get this ptr');
-        }
-        // IMPORTANT: set cid 2 base Pt info firstly
-        this.cid2ThisRefPtMap.set(calleeCid, baseClassPTNode);
-        let thisRefNode = this.getOrNewThisRefNode(calleeCid, thisPtr);
-        thisRefNode.addPTNode(baseClassPTNode);
-        let srcBaseLocal = ivkExpr.getBase();
+    addThisRefCallEdge(baseClassPTNode, cid, baseLocal, callee, calleeCid, callerFunID) {
+        let thisRefNodeID = this.recordThisRefNode(baseClassPTNode, callee, calleeCid);
+        let thisRefNode = this.pag.getNode(thisRefNodeID);
+        let srcBaseLocal = baseLocal;
         srcBaseLocal = this.getRealThisLocal(srcBaseLocal, callerFunID);
         let srcNodeId = this.pag.hasCtxNode(cid, srcBaseLocal);
         if (!srcNodeId) {
@@ -776,12 +774,30 @@ class PagBuilder {
         this.pag.addPagEdge(this.pag.getNode(srcNodeId), thisRefNode, Pag_1.PagEdgeKind.This);
         return srcNodeId;
     }
+    recordThisRefNode(baseClassPTNode, callee, calleeCid) {
+        var _a;
+        if (!callee || !callee.getCfg()) {
+            logger.error(`callee is null`);
+            return -1;
+        }
+        let thisAssignStmt = (_a = callee.getCfg()) === null || _a === void 0 ? void 0 : _a.getStmts().filter(s => s instanceof Stmt_1.ArkAssignStmt && s.getRightOp() instanceof Ref_1.ArkThisRef);
+        let thisPtr = (thisAssignStmt === null || thisAssignStmt === void 0 ? void 0 : thisAssignStmt.at(0)).getRightOp();
+        if (!thisPtr) {
+            throw new Error('Can not get this ptr');
+        }
+        // IMPORTANT: set cid 2 base Pt info firstly
+        this.cid2ThisRefPtMap.set(calleeCid, baseClassPTNode);
+        let thisRefNode = this.getOrNewThisRefNode(calleeCid, thisPtr);
+        thisRefNode.addPTNode(baseClassPTNode);
+        return thisRefNode.getID();
+    }
     /*
      * Add copy edges from arguments to parameters
      *     ret edges from return values to callsite
      * Return src node
      */
-    addStaticPagCallEdge(cs, callerCid, calleeCid) {
+    addStaticPagCallEdge(cs, callerCid, calleeCid, ptNode) {
+        var _a, _b, _c, _d;
         if (!calleeCid) {
             calleeCid = this.ctx.getOrNewContext(callerCid, cs.calleeFuncID, true);
         }
@@ -804,21 +820,100 @@ class PagBuilder {
         let calleeCS = this.buildFuncPagAndAddToWorklist(new CSFuncID(calleeCid, cs.calleeFuncID));
         // callee cid will updated if callee is singleton
         calleeCid = calleeCS.cid;
-        // TODO: getParameterInstances's performance is not good. Need to refactor 
+        let realArgs = (_a = cs.args) !== null && _a !== void 0 ? _a : [];
+        let argsOffset = 0;
+        if (ptNode && ptNode instanceof Pag_1.PagFuncNode && ptNode.getCS()) {
+            // for ptr invoke cloned by Function.bind()
+            realArgs = (_b = ptNode.getCS().args) !== null && _b !== void 0 ? _b : [];
+            argsOffset = (_c = ptNode.getArgsOffset()) !== null && _c !== void 0 ? _c : 0;
+            callerCid = (_d = ptNode.getOriginCid()) !== null && _d !== void 0 ? _d : callerCid;
+        }
+        srcNodes.push(...this.addCallParamPagEdge(calleeMethod, realArgs, cs.callStmt, callerCid, calleeCid, argsOffset));
+        srcNodes.push(...this.addCallReturnPagEdge(calleeMethod, cs.callStmt, callerCid, calleeCid));
+        return srcNodes;
+    }
+    /**
+     * only process the param PAG edge for invoke stmt
+     */
+    addCallParamPagEdge(calleeMethod, args, callStmt, callerCid, calleeCid, offset) {
+        var _a;
         let params = calleeMethod.getCfg().getStmts()
             .filter(stmt => stmt instanceof Stmt_1.ArkAssignStmt && stmt.getRightOp() instanceof Ref_1.ArkParameterRef)
             .map(stmt => stmt.getRightOp());
-        srcNodes.push(...this.addCallParamPagEdge(params, cs, callerCid, calleeCid));
+        let srcNodes = [];
+        /**
+         *  process foreach situation
+         *  e.g. arr.forEach((item) => { ... })
+         *  cs.args is anonymous method local, will have only 1 parameter
+         *  but inside foreach will have >= 1 parameters
+         */
+        if (((_a = callStmt.getInvokeExpr()) === null || _a === void 0 ? void 0 : _a.getMethodSignature().getMethodSubSignature().getMethodName()) === 'forEach') {
+            srcNodes.push(...this.addForeachParamPagEdge(callerCid, calleeCid, callStmt, params));
+            return srcNodes;
+        }
+        // add args to parameters edges
+        for (let i = offset; i <= args.length; i++) {
+            let arg = args.at(i);
+            let param = params.at(i - offset);
+            if (!arg || !param) {
+                return srcNodes;
+            }
+            if (arg instanceof Constant_1.Constant || arg instanceof Expr_1.AbstractExpr) {
+                // TODO: handle AbstractExpr
+                continue;
+            }
+            // Get or create new PAG node for argument and parameter
+            let srcPagNode = this.getOrNewPagNode(callerCid, arg, callStmt);
+            let dstPagNode = this.getOrNewPagNode(calleeCid, param, callStmt);
+            this.pag.addPagEdge(srcPagNode, dstPagNode, Pag_1.PagEdgeKind.Copy, callStmt);
+            srcNodes.push(srcPagNode.getID());
+            // TODO: handle other types of parmeters
+        }
+        return srcNodes;
+    }
+    /**
+     * temporary solution for foreach
+     * deprecate when foreach is handled by built-in method
+     * connect the element node with the value inside foreach
+     */
+    addForeachParamPagEdge(callerCid, calleeCid, callStmt, params) {
+        // container value is the base value of callstmt, its points-to is PagNewContainerExprNode
+        let srcNodes = [];
+        let containerValue = callStmt.getInvokeExpr().getBase();
+        let param = params.at(0);
+        if (!containerValue || !param) {
+            return srcNodes;
+        }
+        let basePagNode = this.getOrNewPagNode(callerCid, containerValue, callStmt);
+        let dstPagNode = this.getOrNewPagNode(calleeCid, param, callStmt);
+        for (let pt of basePagNode.getPointTo()) {
+            let newContainerExprPagNode = this.pag.getNode(pt);
+            // PagNewContainerExprNode's points-to is the element node
+            if (!newContainerExprPagNode || !newContainerExprPagNode.getElementNode()) {
+                continue;
+            }
+            let srcPagNode = this.pag.getNode(newContainerExprPagNode.getElementNode());
+            // connect the element node with the value inside foreach
+            this.pag.addPagEdge(srcPagNode, dstPagNode, Pag_1.PagEdgeKind.Copy, callStmt);
+            srcNodes.push(srcPagNode.getID());
+        }
+        return srcNodes;
+    }
+    /**
+     * process the return value PAG edge for invoke stmt
+     */
+    addCallReturnPagEdge(calleeMethod, callStmt, callerCid, calleeCid) {
+        let srcNodes = [];
         // add ret to caller edges
         let retStmts = calleeMethod.getReturnStmt();
         // TODO: call statement must be a assignment state
-        if (cs.callStmt instanceof Stmt_1.ArkAssignStmt) {
-            let retDst = cs.callStmt.getLeftOp();
+        if (callStmt instanceof Stmt_1.ArkAssignStmt) {
+            let retDst = callStmt.getLeftOp();
             for (let retStmt of retStmts) {
                 let retValue = retStmt.getOp();
                 if (retValue instanceof Local_1.Local) {
                     let srcPagNode = this.getOrNewPagNode(calleeCid, retValue, retStmt);
-                    let dstPagNode = this.getOrNewPagNode(callerCid, retDst, cs.callStmt);
+                    let dstPagNode = this.getOrNewPagNode(callerCid, retDst, callStmt);
                     this.pag.addPagEdge(srcPagNode, dstPagNode, Pag_1.PagEdgeKind.Copy, retStmt);
                 }
                 else if (retValue instanceof Constant_1.Constant) {
@@ -850,62 +945,6 @@ class PagBuilder {
         srcNodes.push(...this.addSDKMethodReturnPagEdge(cs, callerCid, calleeCid, calleeMethod));
         return srcNodes;
     }
-    addCallParamPagEdge(params, cs, callerCid, calleeCid) {
-        var _a, _b, _c;
-        let srcNodes = [];
-        let argNum = (_a = cs.args) === null || _a === void 0 ? void 0 : _a.length;
-        if (argNum === params.length) {
-            // add args to parameters edges
-            for (let i = 0; i < argNum; i++) {
-                let arg = (_b = cs.args) === null || _b === void 0 ? void 0 : _b.at(i);
-                let param = params.at(i);
-                if (!arg || !param) {
-                    return srcNodes;
-                }
-                if (arg instanceof Constant_1.Constant || arg instanceof Expr_1.AbstractExpr) {
-                    // TODO: handle AbstractExpr
-                    continue;
-                }
-                // Get or create new PAG node for argument and parameter
-                let srcPagNode = this.getOrNewPagNode(callerCid, arg, cs.callStmt);
-                let dstPagNode = this.getOrNewPagNode(calleeCid, param, cs.callStmt);
-                this.pag.addPagEdge(srcPagNode, dstPagNode, Pag_1.PagEdgeKind.Copy, cs.callStmt);
-                srcNodes.push(srcPagNode.getID());
-                // TODO: handle other types of parmeters
-            }
-        }
-        else {
-            /**
-             *  process foreach situation
-             *  e.g. arr.forEach((item) => { ... })
-             *  cs.args is anonymous method local, will have only 1 parameter
-             *  but inside foreach will have >= 1 parameters
-             */
-            if (!(((_c = cs.callStmt.getInvokeExpr()) === null || _c === void 0 ? void 0 : _c.getMethodSignature().getMethodSubSignature().getMethodName()) === 'forEach')) {
-                return srcNodes;
-            }
-            // container value is the base value of callstmt, its points-to is PagNewContainerExprNode
-            let containerValue = cs.callStmt.getInvokeExpr().getBase();
-            let param = params.at(0);
-            if (!containerValue || !param) {
-                return srcNodes;
-            }
-            let basePagNode = this.getOrNewPagNode(callerCid, containerValue, cs.callStmt);
-            let dstPagNode = this.getOrNewPagNode(calleeCid, param, cs.callStmt);
-            for (let pt of basePagNode.getPointTo()) {
-                let newContainerExprPagNode = this.pag.getNode(pt);
-                // PagNewContainerExprNode's points-to is the element node
-                if (!newContainerExprPagNode || !newContainerExprPagNode.getElementNode()) {
-                    continue;
-                }
-                let srcPagNode = this.pag.getNode(newContainerExprPagNode.getElementNode());
-                // connect the element node with the value inside foreach
-                this.pag.addPagEdge(srcPagNode, dstPagNode, Pag_1.PagEdgeKind.Copy, cs.callStmt);
-                srcNodes.push(srcPagNode.getID());
-            }
-        }
-        return srcNodes;
-    }
     addSDKMethodPagCallEdge(cs, callerCid, calleeCid) {
         let srcNodes = [];
         let calleeNode = this.cg.getNode(cs.calleeFuncID);
@@ -913,8 +952,9 @@ class PagBuilder {
         if (!calleeMethod) {
             return srcNodes;
         }
+        let methodType = (0, PTAUtils_1.getBuiltInApiType)(calleeMethod.getSignature());
         // block the container SDK
-        if ((0, PTAUtils_1.IsCollectionAPI)(calleeMethod.getSignature())) {
+        if (methodType === PTAUtils_1.BuiltApiType.SetAdd || PTAUtils_1.BuiltApiType.MapSet) {
             return srcNodes;
         }
         if (!this.methodParamValueMap.has(calleeNode.getID())) {
@@ -995,33 +1035,6 @@ class PagBuilder {
         }
         return srcNodes;
     }
-    processContainerPagCallEdge(cs, cid, baseClassPTNode) {
-        let srcNodes = [];
-        let calleeNode = this.cg.getNode(cs.calleeFuncID);
-        let calleeMethod = this.scene.getMethod(calleeNode.getMethod());
-        let ptNode = this.pag.getNode(baseClassPTNode);
-        if (!calleeMethod || !(ptNode instanceof Pag_1.PagNewContainerExprNode)) {
-            return srcNodes;
-        }
-        let containerValue = cs.callStmt.getInvokeExpr().getBase();
-        const containerValueProcess = (argIndex) => {
-            let srcNode = this.pag.getOrNewNode(cid, cs.args[argIndex], cs.callStmt);
-            let realContainerFieldPagNode = this.pag.getOrClonePagContainerFieldNode(baseClassPTNode, undefined, containerValue);
-            if (realContainerFieldPagNode) {
-                // In some cases, the value of a variable of array type may not be an explicit array object,
-                // and the value of `realContainerFieldPagNode` will be undefined.
-                this.pag.addPagEdge(srcNode, realContainerFieldPagNode, Pag_1.PagEdgeKind.Copy, cs.callStmt);
-                srcNodes.push(srcNode.getID());
-            }
-        };
-        if ((0, PTAUtils_1.IsCollectionSetAdd)(calleeMethod.getSignature())) {
-            containerValueProcess(0);
-        }
-        else if ((0, PTAUtils_1.IsCollectionMapSet)(calleeMethod.getSignature())) {
-            containerValueProcess(1);
-        }
-        return srcNodes;
-    }
     getOrNewPagNode(cid, v, s) {
         if (v instanceof Ref_1.ArkThisRef) {
             return this.getOrNewThisRefNode(cid, v);
@@ -1271,6 +1284,129 @@ class PagBuilder {
         }
         return Pag_1.PagEdgeKind.Unknown;
     }
+    /**
+     * process Storage API
+     * @returns boolean: check if the cs represent a Storage API, no matter the API will success or fail
+     */
+    processStorage(cs, calleeCGNode, cid) {
+        let storageName = calleeCGNode.getMethod().getDeclaringClassSignature().getClassName();
+        let storageType = this.getStorageType(storageName, cs, cid);
+        // TODO: add other storages
+        if (storageType === Pag_1.StorageType.APP_STORAGE) {
+            let calleeName = calleeCGNode.getMethod().getMethodSubSignature().getMethodName();
+            // TODO: complete AppStorage API
+            if (calleeName === 'setOrCreate') {
+                this.processStorageSetOrCreate(cs, cid);
+            }
+            else if (calleeName === 'link') {
+                this.processStorageLink(cs, cid);
+            }
+            else if (calleeName === 'prop') {
+                this.processStorageProp(cs, cid);
+            }
+            else if (calleeName === 'set') {
+                this.processStorageSet(cs, cid);
+            }
+            else if (calleeName === 'get') {
+                this.processStorageGet(cs, cid);
+            }
+            return true;
+        }
+        else if (storageType === Pag_1.StorageType.LOCAL_STORAGE) {
+            // TODO: LocalStorage is not Static
+        }
+        return false;
+    }
+    processStorageSetOrCreate(cs, cid) {
+        let propertyStr = this.getPropertyName(cs.args[0]);
+        if (!propertyStr) {
+            return;
+        }
+        let propertyName = propertyStr;
+        let propertyNode = this.getOrNewPropertyNode(Pag_1.StorageType.APP_STORAGE, propertyName, cs.callStmt);
+        let storageObj = cs.args[1];
+        this.addPropertyLinkEdge(propertyNode, storageObj, cid, cs.callStmt, Pag_1.StorageLinkEdgeType.Local2Property);
+    }
+    processStorageLink(cs, cid) {
+        let propertyStr = this.getPropertyName(cs.args[0]);
+        if (!propertyStr) {
+            return;
+        }
+        let propertyName = propertyStr;
+        let propertyNode = this.getOrNewPropertyNode(Pag_1.StorageType.APP_STORAGE, propertyName, cs.callStmt);
+        let leftOp = cs.callStmt.getLeftOp();
+        let linkedOpNode = this.pag.getOrNewNode(cid, leftOp);
+        if (linkedOpNode instanceof Pag_1.PagLocalNode) {
+            linkedOpNode.setStorageLink(Pag_1.StorageType.APP_STORAGE, propertyName);
+        }
+        this.pag.addPagEdge(propertyNode, linkedOpNode, Pag_1.PagEdgeKind.Copy);
+        this.pag.addPagEdge(linkedOpNode, propertyNode, Pag_1.PagEdgeKind.Copy);
+    }
+    processStorageProp(cs, cid) {
+        let propertyStr = this.getPropertyName(cs.args[0]);
+        if (!propertyStr) {
+            return;
+        }
+        let propertyName = propertyStr;
+        let propertyNode = this.getOrNewPropertyNode(Pag_1.StorageType.APP_STORAGE, propertyName, cs.callStmt);
+        let leftOp = cs.callStmt.getLeftOp();
+        let linkedOpNode = this.pag.getOrNewNode(cid, leftOp);
+        if (linkedOpNode instanceof Pag_1.PagLocalNode) {
+            linkedOpNode.setStorageLink(Pag_1.StorageType.APP_STORAGE, propertyName);
+        }
+        this.pag.addPagEdge(propertyNode, linkedOpNode, Pag_1.PagEdgeKind.Copy);
+    }
+    processStorageSet(cs, cid) {
+        let ivkExpr = cs.callStmt.getInvokeExpr();
+        if (ivkExpr instanceof Expr_1.ArkInstanceInvokeExpr) {
+            let base = ivkExpr.getBase();
+            let baseNode = this.pag.getOrNewNode(cid, base);
+            if (baseNode.isStorageLinked()) {
+                let argsNode = this.pag.getOrNewNode(cid, cs.args[0]);
+                this.pag.addPagEdge(argsNode, baseNode, Pag_1.PagEdgeKind.Copy);
+            }
+        }
+        else if (ivkExpr instanceof Expr_1.ArkStaticInvokeExpr) {
+            // TODO: process AppStorage.set()
+        }
+    }
+    processStorageGet(cs, cid) {
+        if (!(cs.callStmt instanceof Stmt_1.ArkAssignStmt)) {
+            return;
+        }
+        let leftOp = cs.callStmt.getLeftOp();
+        let ivkExpr = cs.callStmt.getInvokeExpr();
+        let propertyName;
+        if (ivkExpr instanceof Expr_1.ArkStaticInvokeExpr) {
+            let propertyStr = this.getPropertyName(cs.args[0]);
+            if (propertyStr) {
+                propertyName = propertyStr;
+            }
+        }
+        else if (ivkExpr instanceof Expr_1.ArkInstanceInvokeExpr) {
+            let baseNode = this.pag.getOrNewNode(cid, ivkExpr.getBase());
+            if (baseNode.isStorageLinked()) {
+                propertyName = baseNode.getStorage().PropertyName;
+            }
+        }
+        let propertyNode = this.getPropertyNode(Pag_1.StorageType.APP_STORAGE, propertyName, cs.callStmt);
+        if (!propertyNode) {
+            return;
+        }
+        this.pag.addPagEdge(propertyNode, this.pag.getOrNewNode(cid, leftOp, cs.callStmt), Pag_1.PagEdgeKind.Copy, cs.callStmt);
+    }
+    getPropertyName(value) {
+        if (value instanceof Local_1.Local) {
+            let type = value.getType();
+            if (type instanceof Type_1.StringType) {
+                return type.getName();
+            }
+        }
+        else if (value instanceof Constant_1.Constant) {
+            return value.getValue();
+        }
+        return undefined;
+    }
     /**
      * get storageType enum with method's Declaring ClassName
      *
@@ -1449,7 +1585,6 @@ class PagBuilder {
     }
     getSourceValueFromExternalScope(value, funcID) {
         let sourceValue;
-        // TODO: first from default method
         sourceValue = this.getDefaultMethodSourceValue(value, funcID);
         if (!sourceValue) {
             sourceValue = this.getExportSourceValue(value, funcID);
@@ -1536,5 +1671,37 @@ class PagBuilder {
         this.retriggerNodesList.clear();
         return retriggerNodes;
     }
+    addUpdatedNode(nodeID, diffPT) {
+        var _a;
+        let ptaConfig = PointerAnalysisConfig_1.PointerAnalysisConfig.getInstance();
+        let updatedNode = (_a = this.updatedNodesThisRound.get(nodeID)) !== null && _a !== void 0 ? _a : new ptaConfig.ptsCollectionCtor();
+        updatedNode.union(diffPT);
+        this.updatedNodesThisRound.set(nodeID, updatedNode);
+    }
+    getUpdatedNodes() {
+        return this.updatedNodesThisRound;
+    }
+    resetUpdatedNodes() {
+        this.updatedNodesThisRound.clear();
+    }
+    transferArrayValues(method, arrayLocal) {
+        if (!(arrayLocal instanceof Local_1.Local) || !(arrayLocal.getType() instanceof Type_1.ArrayType)) {
+            return [];
+        }
+        /**
+         * TODO: get array element values
+         * need to resolve multi dimension array
+         */
+        const usedValuesInArray = arrayLocal.getUsedStmts().flatMap(stmt => {
+            if (stmt instanceof Stmt_1.ArkAssignStmt) {
+                const rightOp = stmt.getRightOp();
+                if (rightOp instanceof Local_1.Local) {
+                    return rightOp;
+                }
+            }
+            return [];
+        });
+        return usedValuesInArray;
+    }
 }
 exports.PagBuilder = PagBuilder;