我们最近提交苹果应用审核,遇到 2.5.2 审核问题。具体内容如下:
Your app, extension, or linked framework appears to contain code designed explicitly with the capabllity to change the app's behavior or functionality after App Review approval.
This code, combined with a remote resource, can facilitate significant changes to the app's behavior compared to when it was initially reviewed. While you may not be using this functionality currently, it has the potential to load private frameworks, private methods, and enable future feature changes. This includes any code which passes arbitrary parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, method_exchangeImplementations(), and running remote scripts in order to change app behavior and/or call SPI, based on the contents of the downloaded script. Even if the remote resource is not intentionally mailcious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of the app.
Next Steps
- Learn more about software requirements in guideline 2.5.2.
- Revise the app to comply with these requirements.
- Once the app is fully compliant, resubmit the app for review.
我们扫描打包后的 ipa 包,DCloud 相关库也有在使用敏感方法,想问一下应该如何解决?
- 文件: Payload/HBuilder.app/Frameworks/DCUniBase.framework/DCUniBase 包含字符串: dlsym
- 文件: Payload/HBuilder.app/Frameworks/DCUniBase.framework/DCUniBase 包含字符串: respondsToSelector
- 文件: Payload/HBuilder.app/Frameworks/DCUniBase.framework/DCUniBase 包含字符串: performSelector
- 文件: Payload/HBuilder.app/Frameworks/DCloudUTSFoundation.framework/DCloudUTSFoundation 包含字符串: dlsym
- 文件: Payload/HBuilder.app/Frameworks/DCloudUTSFoundation.framework/DCloudUTSFoundation 包含字符串: respondsToSelector
- 文件: Payload/HBuilder.app/Frameworks/DCloudUTSFoundation.framework/DCloudUTSFoundation 包含字符串: performSelector
或者官方能否提供类似《DCloud 框架合规说明》说明框架中敏感 API 的用途和,没有远程代码修改能力的说明。
HBuilderX 具体版本号:4.45
是否集成第三方热更新服务:没有
打包方式(云端/离线):云端
2 个回复
Ask小助手
苹果2.5.2审核问题针对的是应用中存在可动态修改行为的代码风险。您提到的DCloud框架中检测到的
dlsym、respondsToSelector、performSelector等方法是框架内部实现机制(如插件热更新、模块通信),并非用于远程加载可执行代码。DCloud官方已多次声明其框架设计符合苹果规范,无远程代码修改能力。解决方案建议:
eval()、JavaScriptCore执行远程下载的脚本,确保所有业务逻辑均在本地。m***@yidatech.top (作者)
我后续更新 HBuilderX 到最新版本,使用云端打包可以优化相关实现吗?官方能够提供一下书面说明的模板。
要回复问题请先登录或注册
公告
更多>相关问题