一.今天一早不少iOS開發(fā)者收到了蘋果的警告郵件,內(nèi)容如下:
Your app, extension, and/or linked framework appears to contain code designed explicitly with the capability to change your app’s behavior or functionality after App Review approval, which is not in compliance with section 3.3.2 of the Apple Developer Program License Agreement and App Store Review Guideline 2.5.2. This code, combined with a remote resource, can facilitate significant changes to your app’s behavior compared to when it was initially reviewed for the App Store. While you may not be using this functionality currently, it has the potential to load private frameworks, private methods, and enable future feature changes.
This includes any code which passes arbitrary parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, method_exchangeImplementations(), and running remote scripts in order to change app behavior or call SPI, based on the contents of the downloaded script. Even if the remote resource is not intentionally malicious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of your app.
Please perform an in-depth review of your app and remove any code, frameworks, or SDKs that fall in line with the functionality described above before submitting the next update for your app for review.
Best regards
App store Review
二.蘋果審核協(xié)議中有這樣二項(xiàng)
由于開發(fā)者APP中集成或SDK中包含了熱更新功能,受到蘋果警告.
熱更新技術(shù)可以幫開發(fā)者避免長(zhǎng)時(shí)間的審核等待以及多次被拒造成的成本開銷,以及快速修復(fù)線上Bug,但也給黑客留了后門，也就違反了蘋果的安全和隱私政策.
從蘋果的角度看，禁止應(yīng)用使用熱更新技術(shù)更多是為了保護(hù)用戶隱私出革、數(shù)據(jù)安全以及其全力打造的生態(tài)圈.
作為開發(fā)者,蘋果爸爸開始抓這一塊,我們還是老老實(shí)實(shí)去除應(yīng)用熱更新功能吧
三.目前已知有高德地圖印蔗、個(gè)推男应、BugTags脾猛、Bugly含有熱更新功能
1.高德地圖
高德地圖已在第一時(shí)間修復(fù)并更新了SDK
1.請(qǐng)更新基礎(chǔ)SDK - FoundationSDK至V1.3.4版本.
注意:哪里用到過基礎(chǔ)SDK?
iOS地圖(3D/2D)SDK V4.0.0 版箍镜、iOS 定位 SDK V2.0.0 版嗤锉、iOS 導(dǎo)航 SDK V2.0.0 版之后的全部 iOS SDK 均有引入基礎(chǔ)SDK - FoundationSDK
2.請(qǐng)更新定位SDK到V2.3.0版本
2.個(gè)推
個(gè)推暫時(shí)還沒有推出更新.
但可咨詢技術(shù)支持,
提供去除JSPatch臨時(shí)包解決問題,
官方將在下周一(3.13)更新SDK解決該問題
3.BugTags
BugTags 本身沒有直接集成JSPatch,只有動(dòng)態(tài)監(jiān)測(cè)應(yīng)用是否集成了JSPatch,但依然會(huì)陪apple 認(rèn)定為包含動(dòng)態(tài)更新功能,
官方已緊急發(fā)布SDK v2.2.1版本移除JSPacth相關(guān)代碼
4.Bugly
官方提示:
由于 Apple 審核政策調(diào)整渔欢，我們正在關(guān)注是否影響熱更新 SDK 功能。
JSPatch
JSPatch issue區(qū)炸鍋了https://github.com/bang590/JSPatch/issues/746
四.最后來個(gè)段子(摘自網(wǎng)絡(luò))
祝愿所有開發(fā)者都能順利通過審核并上線.
