Apple警告邮件 - Githubissues

kunwang0916 commented 7 years ago

统一回复：关于苹果警告 http://blog.cnbang.net/internet/3374/

今天收到Apple的警告邮件。应用中使用了JSPatch一段时间了，之前的版本是没有问题的。而且这个通知邮件也不是在提交更新版本审核过程中收到，而是苹果主动发出的。

是否和JSPatch有关？
如果有关请问是否有解决方案。
~其它开发者最近有收到类似邮件的话，也请分享一下。~ 请不要灌水。
相关信息 / Related information

Dear Developer,

Your app, extension, and/or linked framework appears to contain code designed explicitly with the capability to change your app’s behavior or functionality after App Review approval, which is not in compliance with section 3.3.2 of the Apple Developer Program License Agreement and App Store Review Guideline 2.5.2. This code, combined with a remote resource, can facilitate significant changes to your app’s behavior compared to when it was initially reviewed for the App Store. While you may not be using this functionality currently, it has the potential to load private frameworks, private methods, and enable future feature changes.

This includes any code which passes arbitrary parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, method_exchangeImplementations(), and running remote scripts in order to change app behavior or call SPI, based on the contents of the downloaded script. Even if the remote resource is not intentionally malicious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of your app.

Please perform an in-depth review of your app and remove any code, frameworks, or SDKs that fall in line with the functionality described above before submitting the next update for your app for review.

Best regards,

App Store Review

fengqiangboy commented 7 years ago

同收到~

bhltyou commented 7 years ago

@catcups 你用的假的热修复

lzbSun commented 7 years ago

持续关注中~

garinyong commented 7 years ago

mark

Gilbertat commented 7 years ago

苹果爸爸会不会在自己的生态中搞死js啊

zekunyan commented 7 years ago

持续关注中

luohui8891 commented 7 years ago

respondsToSelector:, performSelector:, method_exchangeImplementations() 这三个方法用得更加广泛，也要去掉？

@bigyelow 他警告是说，类似JSPatch这样的远程更新代码的机制，可以调用这些动态方法来hack你的app。

zzyspace commented 7 years ago

我们也收到了这个警告, 但是我们早前的版本就已经移除JSPatch了

bigyelow commented 7 years ago

@luohui8891 嗯，有理有据的封杀 JSPatch，不知道 wax 什么情况

luohui8891 commented 7 years ago

我们也是昨天收到的，目前没有什么对策。我们的APP只是用JSPatch做热修复，并不修改应用的功能行为等（但我觉得Apple并不care这个）。

itamaker commented 7 years ago

@zzyspace 你的app被下架了？

iseeicando commented 7 years ago

+1 名下10多个app都被警告了。。。

zzyspace commented 7 years ago

@itamaker 看错了, 是警告

vagase commented 7 years ago

+1

peixl commented 7 years ago

+1

lsllsllsl commented 7 years ago

没用 RN 没用 jspatch ，同样收到警告

xingxingc commented 7 years ago

我们这边的没有被下架，刚测了，还可以正常的下载使用，

Qinzhao commented 7 years ago

我也收到了没说必须要更新吧

razioooooo commented 7 years ago

mark关注

itamaker commented 7 years ago

好热闹啊

tcathy commented 7 years ago

我也收到了~·不知道没处理会不会被下架==

GuoCFPlus commented 7 years ago

mark

ganvinalix commented 7 years ago

收到

akamemoe commented 7 years ago

虽然我不是搞IOS的。但是我也还是要关注下。

shalyf commented 7 years ago

mark

shaojiankui commented 7 years ago

目测是批量扫描runtime并且群发的,苹果没办法批量检测remote script,所以机智的检测可能使用到的runtime方法. 让下载脚本代码使用runtime实现的的人下一个版本改掉.如果不改.就被下架被拒绝上架. JSPatch是"下载脚本代码且使用runtime",所以react native ,weex都会有这种提示

lsllsllsl commented 7 years ago

但是RN的群里今天还有人提交并且成功了

luohui8891 commented 7 years ago

@tcathy 根据邮件里说是你下次提交前请去掉这样远程下载代码运行的机制。所以应该就是下个版本如果不删除就reject