Apple警告邮件,禁用JS热更新机制

3.8节一大早相信不少iOS开发者都收到了来自Apple的一封警告邮件:

Dear Developer,Your app, extension, and/or linked framework appears to contain code designed explicitly with 
the capability to change your app’s behavior or functionality after App Review approval, which is not in 
compliance with section 3.3.2 of the [Apple Developer Program License Agreement]
(https://itunesconnect.apple.com/WebObjects/iTunesConnect.woa/ra/ng/%E2%80%9Chttps://developer.apple.com/terms/%E2%80%9C) and [App Store Review Guideline 2.5.2]
(https://itunesconnect.apple.com/WebObjects/iTunesConnect.woa/ra/ng/%E2%80%9Chttps://developer.apple.
com/app-store/review/guidelines/#software-requirements”). This code, combined with a remote resource, can 
facilitate significant changes to your app’s behavior compared to when it was initially reviewed for the App 
Store. While you may not be using this functionality currently, it has the potential to load private frameworks, 
private methods, and enable future feature changes. This includes any code which passes arbitrary 
parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, 
method_exchangeImplementations(), and running remote scripts in order to change app behavior or call SPI, 
based on the contents of the downloaded script. Even if the remote resource is not intentionally malicious, it 
could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security 
vulnerability to users of your app.Please perform an in-depth review of your app and remove any code, 
frameworks, or SDKs that fall in line with the functionality described above before submitting the next update 
for your app for review.Best regards,App Store Review

更新一下,最近了解到的一些进展。

苹果此举主要是针对一些在线下发脚本动态改变App行为的机制。

Paste_Image.png
Paste_Image.png
  • JSPatch受影响么

了解到的JSPatch最新版本肯定是受影响的。一家国外的服务Rollout.io也同样受影响。

  • 没有使用JSPatch也收到警告了

一些三方SDK会使用JSPatch一些机制。

Paste_Image.png
  • RN受影响么

官方SDK是不受影响的。

Paste_Image.png
  • buglyHotfix

暂未受影响。

  • runtime的相关API还可以用么

可以。主要针对脚本下发动态修改App行为做封杀。

  • 为什么我没有收到邮件

1.没有使用到上述这些违反Apple审核规则的机制。
2.你的开发者账号还没有接受最新的开发者协议。


Paste_Image.png

相关链接:

RN
JSPatch

最后编辑于
©著作权归作者所有,转载或内容合作请联系作者
平台声明:文章内容(如有图片或视频亦包括在内)由作者上传并发布,文章内容仅代表作者本人观点,简书系信息发布平台,仅提供信息存储服务。

推荐阅读更多精彩内容