Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

最新消息, 我被拒了,直接拒绝,新版本也不行了? #781

Closed
luyud opened this issue May 10, 2017 · 21 comments
Closed

最新消息, 我被拒了,直接拒绝,新版本也不行了? #781

luyud opened this issue May 10, 2017 · 21 comments

Comments

@luyud
Copy link

luyud commented May 10, 2017

Guideline 2.5.2 - Performance

Your app, extension, or linked framework appears to contain code designed explicitly with the capability to change your app’s behavior or functionality after App Review approval, which is not in compliance with App Store Review Guideline 2.5.2 and section 3.3.2 of the Apple Developer Program License Agreement.

This code, combined with a remote resource, can facilitate significant changes to your app’s behavior compared to when it was initially reviewed for the App Store. While you may not be using this functionality currently, it has the potential to load private frameworks, private methods, and enable future feature changes. This includes any code which passes arbitrary parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, method_exchangeImplementations(), and running remote scripts in order to change app behavior and/or call SPI, based on the contents of the downloaded script. Even if the remote resource is not intentionally malicious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of your app.

@freddiezhao
Copy link

今天早晨刚刚被拒,也是楼主的原因

@ningman
Copy link

ningman commented May 10, 2017

me too!

@fingerplay
Copy link

fingerplay commented May 10, 2017

新版本是做了类名和方法名混淆的? @freddiezhao @ningman @LuYu001

@slemon
Copy link

slemon commented May 10, 2017

改了类名都不行了,也被拒

@ahhsxp
Copy link

ahhsxp commented May 10, 2017

我也是这个原因别拒

@YauzZ
Copy link
Contributor

YauzZ commented May 10, 2017

日了🐶

@gin-melodic
Copy link
Contributor

Apple应该是更新了检测机制,混淆方法失效了。
这次从In Review到Reject只有几秒,应该是自动化手段升级了。

@ahhsxp
Copy link

ahhsxp commented May 10, 2017

@gin7758258 我把JSPatch 去了,依旧被拒,原因还是这个 只是用了最新版的Bugly,郁闷了

@wesleydotyang
Copy link

@ahhsxp bugly也是用的JSPatch,http://bugly.qq.com/bbs/forum.php?mod=viewthread&tid=2871

@ahhsxp
Copy link

ahhsxp commented May 10, 2017

@wesleydotyang 只是使用了Bugly的异常上报,没有使用热修复 而且是使用了最新版

@ningman
Copy link

ningman commented May 10, 2017

新版的Bugly不是说移除了JSPatch了吗?

@ahhsxp
Copy link

ahhsxp commented May 10, 2017

@ningman 恩! 里面没有了 然后还是被拒 一脸懵逼

@wesleydotyang
Copy link

@ahhsxp 看来Bugly已被加入黑名单。。。

@fingerplay
Copy link

是不是误伤啊,bugly 不集成jspatch的版本不应该被拒啊

@withshe
Copy link

withshe commented May 10, 2017

我提交的App也被拒了,原因:

Guideline 2.5.2 - Performance

Your app, extension, or linked framework appears to contain code designed explicitly with the capability to change your app’s behavior or functionality after App Review approval, which is not in compliance with App Store Review Guideline 2.5.2 and section 3.3.2 of the Apple Developer Program License Agreement.

This code, combined with a remote resource, can facilitate significant changes to your app’s behavior compared to when it was initially reviewed for the App Store. While you may not be using this functionality currently, it has the potential to load private frameworks, private methods, and enable future feature changes. This includes any code which passes arbitrary parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, method_exchangeImplementations(), and running remote scripts in order to change app behavior and/or call SPI, based on the contents of the downloaded script. Even if the remote resource is not intentionally malicious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of your app.

Next Steps

To resolve this issue, please perform an in-depth review of your app and remove any code, frameworks, or SDKs that fall in line with the functionality described above and resubmit your app’s binary for review.

引入的是JSPatch 1.7,上一个App更新版本也引入了,审核通过,这一次更新版本就被拒了。。。。

@coolwxb
Copy link

coolwxb commented May 11, 2017

早上看邮件同样被拒~悲剧呀 有没有兄弟有解决方案

@ichinadev
Copy link

应该是不行了,今天早上直接rejected。

@bang590
Copy link
Owner

bang590 commented May 11, 2017

请使用 SDK 1.7.1 版本:https://jspatch.com/Index/sdk

@bang590 bang590 closed this as completed May 11, 2017
@ymsheng
Copy link

ymsheng commented May 27, 2017

5.20号提交的还是被拒了。会有新版本更新吗

@heroims
Copy link

heroims commented Jun 1, 2017

有人试过1.7.2了吗?

@2505183916
Copy link

我被拒了,但是没有使用热更新啊

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests