freehippo
freehippo
  • 发布:2022-03-10 15:28
  • 更新:2022-04-06 09:54
  • 阅读:2298

IOS上架被拒 2.3.1 和 2.5.2

分类:uni-app

苹果审核未通过的内容为:

Guideline 2.3.1 - Performance

We discovered that your app contains hidden features.

Specifically, it would be appropriate to remove any and all remote code importing and code obfuscation or selector mangling, such as this app’s [PDRCoreApp doDownloadWap2app] method and [KCZLFCxPxTbjxx bpXErxxkoMxIeO::] method, before resubmitting for review. It may be appropriate to review any third party frameworks that the app is using as these may contribute to the guideline 2.3.1 and 2.5.2 concerns.

The next submission of this app may require a longer review time, and this app will not be eligible for an expedited review until this issue is resolved.

Guideline 2.5.2 - Performance - Software Requirements

Your app, extension, or linked framework appears to contain code designed explicitly with the capability to change your app’s behavior or functionality after App Review approval, which is not in compliance with App Store Review Guideline 2.5.2 and section 3.3.2 of the Apple Developer Program License Agreement.

This code, combined with a remote resource, can facilitate significant changes to your app’s behavior compared to when it was initially reviewed for the App Store. While you may not be using this functionality currently, it has the potential to load private frameworks, private methods, and enable future feature changes. This includes any code which passes arbitrary parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, method_exchangeImplementations(), and running remote scripts in order to change app behavior and/or call SPI, based on the contents of the downloaded script. Even if the remote resource is not intentionally malicious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of your app.

目前使用第三方包有 js-base64,mp-html,uview-ui,未使用任何原生插件,未使用热更新,项目一开始是用cli创建,已执行 npx @dcloudio/uvm 更新到最新版本,目前使用 hbuild 3.3.11 版本安心打包。
查找打包后的文件,确实发现了 dlopen 函数,请问这是需要怎么调整修改?

2022-03-10 15:28 负责人:DCloud_iOS_XHY 分享
已邀请:

最佳回复

freehippo

freehippo (作者)

Regarding 2.3.1 and 2,5,2 issue, it would be appropriate to remove any and all remote code importing and code obfuscation or selector mangling, such as this app’s [KCZLFCxPxTbjxx bpXErxxkoMxIeO::] method which appears to be part of the app’s GeTui SDK.

追问下审核人员给出进一步信息,指个推SDK问题,目前把推送模块去掉,已经上架成功。

  • DCloud_UNI_GSQ

    很有用的信息,置顶供其他人参考。

    2022-04-06 11:10

  • freehippo (作者)

    回复 DCloud_UNI_GSQ: 虽然上架成功,但根本问题还是没解决,推送功能早晚得加回去,可以将这个信息反馈给个推么

    2022-04-07 10:16

  • DCloud_UNI_GSQ

    回复 freehippo: 目前无其他人反馈类似问题,尝试添加后重新提交审核。

    2022-04-08 20:22

FullStack

FullStack - 【插件开发】【专治疑难杂症】【ios上架、马甲包、白包、过审、已成功上架过几百个】【多款插件已上架:https://ext.dcloud.net.cn/publisher?id=22130】【非诚勿扰】QQ:543610866

得看 dlopen 是在哪个组件用到了

DCloud_iOS_XHY

DCloud_iOS_XHY

能否提供一下 ipa 包?我们分析一下

  • freehippo (作者)

    可以发,另外审核反馈的 such as this app’s [PDRCoreApp doDownloadWap2app] method and [KCZLFCxPxTbjxx bpXErxxkoMxIeO::] method,这些我在打包后的文件里也没用找到,能否帮忙分析一下

    2022-03-11 15:50

  • 文件编辑

    回复 freehippo: 这个原因找到了吗,我也出现了相同的回复

    2022-11-01 14:41

DCloud_UNI_GSQ

DCloud_UNI_GSQ

解决方案:

标:全局查找关键词进行替换,.dlopen 可替换为 ['dl'+'open'],但这并非真正问题所在,此处的 dlopen 字符串只是名称恰好相同。

本:关键字检测,苹果商店并非针对所有应用都有,触发此检测到一般是由其他情况引起商店怀疑导致,比如真的有被发现动态切换商店不被允许出现的内容。应根据实际情况采取对策。

后续框架也会对可能同名的字符串进行处理。

  • freehippo (作者)

    一开始是有引入热更新包,不过是针对安卓的,在后续提交的审核也已经完全删除了。

    不过我这里只有win,ipa 解压后修改替换 .dlopen,重新压缩改后缀,就无法上传 ipa 包了

    2022-03-11 16:06

  • DCloud_UNI_GSQ

    回复 freehippo: 修改打包需要重新签名,可以在mac上使用爱思助手等进行签名。或者打包前可以修改此目录文件:HBuilderX.app/Contents/HBuilderX/plugins/uniapp-cli

    2022-03-14 17:01

  • freehippo (作者)

    回复 DCloud_UNI_GSQ:

    目前仅有win平台

    打包前可以修改此目录文件:HBuilderX.app/Contents/HBuilderX/plugins/uniapp-cli

    这个目录我理解是HB的安装目录吧,例如D:\WorkSoftware\HBuilderX.2.9.8.20201110.full\HBuilderX\plugins\uniapp-cli

    但是该目录下搜索全局并未找到 .dlopen

    2022-03-15 14:53

  • DCloud_UNI_GSQ

    回复 freehippo: view.umd.min.js 文件内没有吗?另外你是否使用了 process.env

    2022-03-18 15:34

  • freehippo (作者)

    回复 DCloud_UNI_GSQ:



    1. view.umd.min.js 这文件不是打包后生成的么,在 uniapp-cli 目录并没有搜到该文件;

    2. 未使用 process.env;

    2022-03-19 09:27

  • DCloud_UNI_GSQ

    回复 freehippo: 这个文件是有的,你再找一下

    2022-03-21 11:26

  • freehippo (作者)

    回复 DCloud_UNI_GSQ: uniapp-cli 下应该是 view.umd.js 这个文件,但并未找到 .dlopen

    2022-03-21 17:07

freehippo

freehippo (作者)

打包前修改 .dlopen,但是在 HB安装目录HBuilderX.app/Contents/HBuilderX/plugins/uniapp-cli 下 ,并未找到 .dlopen,或者全局也未搜到。
希望可以再跟进下这个问题

  • DCloud_UNI_GSQ

    使用 HBuilderX 3.4.3 alpha 重新打包后搜索一下生成文件是否有改善

    2022-03-28 16:49

  • freehippo (作者)

    回复 DCloud_UNI_GSQ: 还是一样,打包后分别在 app-service.js/view.umd.min.js,这两个文件存在 .dlopen

    2022-03-28 20:26

freehippo

freehippo (作者)

项目是 cli 创建的,目前运行 npx @dcloudio/uvm alpha 更新到最新 alpha 版本,还是在 app-service.js 搜索到 .dlopen,view.umd.min.js 不存在了

  • DCloud_UNI_GSQ

    app-service是由开发者的代码编译生成的,你查找你的代码以及你所依赖的三方库是否有用到 process.env

    2022-03-30 20:58

  • freehippo (作者)

    回复 DCloud_UNI_GSQ: process.env 是会引入 .dlopen 么,在第三方库里确实看到 process.env 使用

    2022-03-31 10:48

  • DCloud_UNI_GSQ

    回复 freehippo: process.env 会导致编译的结果包含dlopen方法,不过这个是个空方法,就是模拟process导致的。

    2022-03-31 10:55

freehippo

freehippo (作者)

已经删掉所有 process.env,打包后检查 app-service.js 也是正常,但是提交反馈还是一样的内容。

Guideline 2.3.1 - Performance

We discovered that your app contains obfuscated code, selector mangling, or features meant to subvert the App Review process by changing this app's concept after approval to the App Store.

Specifically, it would be appropriate to remove any and all code obfuscation or selector mangling from this app, such as this app’s [bxTxVqLxxxxXxd xxBKOxxxxmxLKx] and [fxxJMxJxAxNxKN locationManager] methods.

Guideline 2.5.2 - Performance - Software Requirements

Your app, extension, or linked framework appears to contain code designed explicitly with the capability to change your app’s behavior or functionality after App Review approval, which is not in compliance with App Store Review Guideline 2.5.2 and section 3.3.2 of the Apple Developer Program License Agreement.

Specifically, it would be appropriate to remove any and all remote code importing or hot updating functionality from this app before resubmitting for review, such as via this app’s [PDRCoreApp doDownloadWap2app] and [LFDownloadManager downloadInfo:] methods.

可能重点在反馈里提到使用的方法,例如 [fxxJMxJxAxNxKN locationManager] methods,但是查遍整个代码,都没有发现这些,能否再帮忙分析下

该问题目前已经被锁定, 无法添加新回复