Apple Store refuses to launch the app and asks to delete Code-push

mingmingshen commented 3 years ago

Steps to Reproduce

Apps that include Code-push on the shelves, the Apple Store reviewed it and rejected it in violation of 2.3.1 and 2.5.2. Hope to be able to get help here, or get some methods, thank you all ❤️🌹🌹

Expected Behavior

How to put this application on the shelf correctly without being rejected by the Apple Store? Must Code-push be deleted?

Actual Behavior

About the application of Code-push in my project

No other code about the method is used

Before the application review, no update bundle was provided to Code-push-server, but it was rejected by the Apple Store. The content of the rejection is as follows ⬇️

Guideline 2.3.1 - Performance

We continue to discover that your app contains hidden features.

Specifically, it would be appropriate to remove any and all remote code importing or hot updating functionality from this app before resubmitting for review, such as via this app’s CodePush support.

The next submission of this app may require a longer review time, and this app will not be eligible for an expedited review until this issue is resolved.

Guideline 2.5.2 - Performance - Software Requirements

Your app, extension, or linked framework still appears to contain code designed explicitly with the capability to change your app’s behavior or functionality after App Review approval, which is not in compliance with App Store Review Guideline 2.5.2 and section 3.3.2 of the Apple Developer Program License Agreement.

Specifically, it would be appropriate to remove any and all remote code importing or hot updating functionality from this app before resubmitting for review, such as via this app’s CodePush support.

This code, combined with a remote resource, can facilitate significant changes to your app’s behavior compared to when it was initially reviewed for the App Store. While you may not be using this functionality currently, it has the potential to load private frameworks, private methods, and enable future feature changes. This includes any code which passes arbitrary parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, method_exchangeImplementations(), and running remote scripts in order to change app behavior and/or call SPI, based on the contents of the downloaded script. Even if the remote resource is not intentionally malicious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of your app.

The next submission of this app may require a longer review time, and this app will not be eligible for an expedited review until this issue is resolved.

Environment

react-native-code-push version:"^7.0.1"
react-native version:"0.63.4"
iOS/Android version:all versions
Release build

My package.json

"dependencies": { "@babel/plugin-proposal-class-properties": "^7.13.0", "@babel/plugin-proposal-decorators": "^7.13.15", "@ptomasroos/react-native-multi-slider": "^2.2.2", "@react-native-community/async-storage": "^1.12.1", "@react-native-community/datetimepicker": "^3.4.6", "@react-native-community/masked-view": "^0.1.11", "@react-native-community/picker": "^1.8.1", "@react-native-community/toolbar-android": "^0.1.0-rc.2", "@react-navigation/bottom-tabs": "^5.11.10", "@react-navigation/core": "^5.15.3", "@react-navigation/drawer": "^5.12.5", "@react-navigation/native": "^5.9.4", "@react-navigation/stack": "^5.14.4", "@rematch/core": "^1.1.0", "@rematch/loading": "^0.5.1", "@rematch/persist": "^1.1.6", "@rematch/updated": "^0.1.5", "axios": "^0.21.1", "dayjs": "^1.10.4", "janalytics-react-native": "^1.4.6", "jcore-react-native": "^1.9.0", "jpush-react-native": "^2.8.2", "native-echarts": "https://github.com/puti94/react-native-echarts.git", "react": "16.13.1", "react-native": "0.63.4", "react-native-amap-geolocation": "^1.1.2", "react-native-ble-manager": "^7.4.2", "react-native-camera": "^3.43.6", "react-native-code-push": "^7.0.1", "react-native-datepicker": "^1.7.2", "react-native-device-info": "^8.1.2", "react-native-gesture-handler": "^1.10.3", "react-native-image-crop-picker": "^0.36.0", "react-native-keyboard-aware-scroll-view": "^0.9.3", "react-native-linear-gradient": "^2.5.6", "react-native-modal-datetime-picker": "^9.2.1", "react-native-orientation-locker": "^1.2.0", "react-native-permissions": "^3.0.1", "react-native-picker-select": "^8.0.4", "react-native-qrcode-scanner": "^1.5.4", "react-native-qrcode-svg": "^6.1.1", "react-native-reanimated": "^2.1.0", "react-native-safe-area-context": "^3.2.0", "react-native-screens": "^3.1.1", "react-native-scrollable-tab-view": "^1.0.0", "react-native-shadow-view": "^0.0.1", "react-native-snap-carousel": "^3.9.1", "react-native-splash-screen": "^3.2.0", "react-native-svg": "^12.1.1", "react-native-vector-icons": "6.6.0", "react-native-vlc-media-player": "^1.0.31", "react-native-webview": "^11.4.0", "react-native-wechat-lib": "^1.1.26", "react-redux": "^7.2.3", "redux": "^4.0.5", "redux-logger": "^3.0.6", "teaset": "^0.7.5", "uuid": "^8.3.2", "zoomable-svg": "^5.0.1" }, "devDependencies": { "@babel/core": "^7.13.15", "@babel/runtime": "^7.13.10", "@react-native-community/eslint-config": "^2.0.0", "babel-jest": "^26.6.3", "eslint": "^7.24.0", "jest": "^26.6.3", "metro-react-native-babel-preset": "^0.65.2", "react-test-renderer": "16.13.1" }, "jest": { "preset": "react-native" }

filipef101 commented 3 years ago

Probably because "We continue to discover that your app contains hidden features." they can prevent you at whim to force you to remove codepush, this is the case, so all you can do is remove it.

mingmingshen commented 3 years ago

This refusal has nothing to do with CodePush. After I was rejected by the Apple Store, I carefully reviewed the app’s functions and interface, and discovered the UI we used to display a content because we gave it a clickable interaction and UI The content is about the description of some services. There are some text content. The text content may be misunderstood by the Apple Store reviewers and us. It is considered a game and a hidden function. Although we are not like this, I think This was the reason for the rejection, so I deleted it and resubmitted the app. The app was approved by the Apple Store today.

I did a few points:

Deleted UI that may be ambiguous and buttons with unimplemented functions
Deleted our original function of redirecting to other third-party stores

In this regard, I have a few suggestions for other users who want to be listed on the Apple Store:

The application should avoid some sensitive words, such as fishing, financial services and other texts that may be understood by reviewers as games or financial functions.
It is best to delete unfinished functions directly, do not do UI display and give interactive functions in advance
If you have the function of jumping to a third-party store, you can try to delete it after rejecting it.

mingmingshen commented 3 years ago

Probably because "We continue to discover that your app contains hidden features." they can prevent you at whim to force you to remove codepush, this is the case, so all you can do is remove it.

Thank you for your enthusiastic answer. I have solved this problem and successfully put it on the Apple Store without deleting Code-push

filipef101 commented 3 years ago

I didn't mean to sound like that, it just seemed like you wanted to bypass hiding features in your app, then removed codepush and apple still complained. Glad to hear you solved it :)

abdymm commented 2 years ago

Probably because "We continue to discover that your app contains hidden features." they can prevent you at whim to force you to remove codepush, this is the case, so all you can do is remove it.

Thank you for your enthusiastic answer. I have solved this problem and successfully put it on the Apple Store without deleting Code-push

Hi can I know how you solve it?

microsoft / react-native-code-push