之前開發(fā)者都收到了蘋果2017年的新開發(fā)者審核協(xié)議更新通知。
2017年3月8...注意..是女神節(jié)這天坝辫。大量開發(fā)者收到了被拒絕 被警告的郵件，內(nèi)容如下：
Dear Developer,
Your app, extension, and/or linked framework appears to contain code designed explicitly with the capability to change your app’s behavior or functionality after App Review approval, which is not in compliance with section 3.3.2 of the Apple Developer Program License Agreement and App Store Review Guideline 2.5.2. This code, combined with a remote resource, can facilitate significant changes to your app’s behavior compared to when it was initially reviewed for the App Store. While you may not be using this functionality currently, it has the potential to load private frameworks, private methods, and enable future feature changes.
This includes any code which passes arbitrary parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, method_exchangeImplementations(), and running remote scripts in order to change app behavior or call SPI, based on the contents of the downloaded script. Even if the remote resource is not intentionally malicious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of your app.
Please perform an in-depth review of your app and remove any code, frameworks, or SDKs that fall in line with the functionality described above before submitting the next update for your app for review.
Best regards,
App Store Review
蘋果審核協(xié)議中有這樣一節(jié)：
Apple Developer Program License Agreement
3.3.2 An Application may not download or install executable code. Interpreted code may only be
used in an Application if all scripts, code and interpreters are packaged in the Application and not
downloaded. The only exception to the foregoing is scripts and code downloaded and run by Apple's builtin WebKit framework, provided that such scripts and code do not change the primary purpose of the Application by providing features or functionality that are inconsistent with the intended and advertised purpose of the Application as submitted to the App Store.
App Store Review Guideline
2.5.2 Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code, including other iOS, watchOS, macOS, or tvOS apps.
隨后JSPatch群里 射亏，github上都炸了鍋 ：https://github.com/bang590/JSPatch/issues/746
react-native 的情況：https://github.com/facebook/react-native/issues/12778
Weex ：:https://github.com/alibaba/weex/issues/2875
為什么突然爆發(fā)
突然爆發(fā)并非偶然,蘋果的審核指南一直明確近忙，禁止下載可執(zhí)行代碼竭业，雖然JSPatch等庫使用了JavaScriptCore來巧妙的實現(xiàn)，但也不是長久之計银锻，很多開發(fā)者不自覺的使用其來下發(fā)私有方法等等行為遲早會被蘋果發(fā)現(xiàn)永品。也極大的威脅到了極其注重安全的蘋果
再有就是一切涉及到網(wǎng)絡的都會有安全的風險
還有一個有意思的事實,昨天VS2017發(fā)布，號稱內(nèi)置iOS模擬器,直接開發(fā)React Native：
總結(jié)下波及到的庫
rollout击纬，react native，weex钾麸，JSPatch更振，bugtags，個推 ,bugly with hotfix
為什么沒使用熱更新會收到郵件
個人認為蘋果是批量掃描runtime并且群發(fā)的饭尝，蘋果沒辦法批量檢測remote script(遠程腳本下載)
所以機智的檢測熱更新可能使用到的runtime方法肯腕，比如method_exchangeImplementations。這樣基本全覆蓋了那些使用熱更新的APP钥平。
警告"下載腳本代碼且使用runtime方法實現(xiàn)的的APP"下一個版本改掉实撒，如果不改。有可能被下架被拒絕上架涉瘾。
JSPatch是"下載腳本代碼且使用runtime"知态，并不是針對JSPatch一個庫
rollout，react native立叛，weex都會有這種提示负敏。
bugtags ，個推 這種看似沒有熱更新的其實內(nèi)部集成了JSPatch等庫秘蛇，也會有這種提示
Runtime不能繼續(xù)用了?
個人認為原生代碼中使用runtime還是沒問題其做，只是為了提醒那些使用了runtime并且下載遠程腳本改變app行為的人。
如果蘋果把runtime變成私有方法或去掉.那么Objective-C的優(yōu)勢大大的沒有了.....
文章出處（http://www.skyfox.org/apple-2017-hot-patch.html）
