苹果审核被拒2.5.2，求助，我都关闭了热更新页面

Creator 2.x
#1

Hello,

Thank you for your continued patience.

We are writing to let you know that we have completed the review of your app. Upon further review, we found that your app does not comply with the following guidelines:

Guideline 2.5.2 - Performance - Software Requirements

Your app, extension, or linked framework appears to contain code designed explicitly with the capability to change your app’s behavior or functionality after App Review approval, which is not in compliance with App Store Review Guideline 2.5.2 and section 3.3.2 of the Apple Developer Program License Agreement.

This code, combined with a remote resource, can facilitate significant changes to your app’s behavior compared to when it was initially reviewed for the App Store. While you may not be using this functionality currently, it has the potential to load private frameworks, private methods, and enable future feature changes. This includes any code which passes arbitrary parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, method_exchangeImplementations(), and running remote scripts in order to change app behavior and/or call SPI, based on the contents of the downloaded script. Even if the remote resource is not intentionally malicious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of your app.

The next submission of this app may require a longer review time, and this app will not be eligible for an expedited review until this issue is resolved.

Next Steps

Submitting apps designed to mislead or harm customers or evade the review process may result in the termination of your Apple Developer Program account. Review the Terms & Conditions of the Apple Developer Program to learn more about our policies regarding termination.

Guideline 2.3.1 - Performance

We discovered that your app contains hidden features. Specifically, your app includes signs of remote Javascript code downloading support.

The next submission of this app may require a longer review time, and this app will not be eligible for an expedited review until this issue is resolved.

Next Steps

Submitting apps designed to mislead or harm customers or evade the review process may result in the termination of your Apple Developer Program account. Review the Terms & Conditions of the Apple Developer Program to learn more about our policies regarding termination.

Please note that all apps submitted to the App Store are reviewed against the App Store Review Guidelines, including the Developer Code of Conduct. If we find any issues during our review, the review time of your app will be extended.

You can avoid future extended reviews by ensuring your apps don’t attempt to mislead or harm customers or undermine the review process. Be sure to review the App Store Review Guidelines and read the Developer Code of Conduct so you understand our requirements prior to submitting any apps for review.

We hope you will consider making the necessary changes to be in compliance with the App Store Review Guidelines and will resubmit your revised binary.

Best regards,

App Store Review

#2

最近我被这个问题折磨的死去活来，苹果打电话来说，明确检测到app有提供js远程下载的模块，如果不去掉这个模块再次提交，就会有封号的处罚结果

#3

我在海外的软件就没问题啊，多半是被看到了热更吧，至少和引擎没啥太大关系

#4

我把热更新的页面已经去掉，今天打电话核实说，检测出我代码中包含有支持js热更新的模块

#5

我这前几天也是 去掉js的也不行 然后我把c++里面涉及到热更相关的也都给删除掉了 不过再提审机扫还是说有问题 不过没说具体的问题 后面我们追加了一封邮件 明确说明了所用引擎级及用到的功能 并没有违规的地方 然后就过了

#8

苹果就是这样的，一旦发现你有违规，就给你玩黑白名单那一套，假如你真的没有，可以写邮件告诉他真的没有，一般就重申了，我之前有个功能它说违规了，我也是写个邮件就过了

#9

是的 如果明确没违规 直接和他们说清楚就行 我wx私信你了

#10

我再次发送邮件给审核人员，让他们能不能具体指出问题，回复是
Hello,

It would be appropriate to remove any and all signs of remote code downloading support from your app before resubmitting for review.

We look forward to reviewing your revised app.

Best regards,

App Store Review

明确的说明需要我删除提供下载的代码

#11

苹果上架幺蛾子确实多 热更关系应该不大 我的项目有热更都上好好的 ～ 可能要重新提交 ～ 你这个项目应该已经被定义为严查状态 有点坑了

#12

是很坑啊，怎么解释都没用，还打电话说明确的掌握了我们app包含有支持下载的代码模块。

#13

看人品看运气~

#14

经过大半个月的交涉，苹果终于电话告知我一直被拒的原因，下面是原文：
Thanks for your time on the phone today.

As we discussed, we continue to find that your app contains feature change capable frameworks.

Specifically, we found "remoteManifestUrl” ,”remoteVersionUrl”, “hotUpdateSearchPaths);” “JSON.parse(hotUpdateSearchPaths);” and etc in your app’s coding.

This code, combined with a remote resource, can facilitate significant changes to your app’s behavior compared to when it was initially reviewed for the App Store. While you may not be using this functionality currently, it has the potential to load private frameworks, private methods, and enable future feature changes. This includes any code which passes arbitrary parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, method_exchangeImplementations(), and running remote scripts in order to change app behavior and/or call SPI, based on the contents of the downloaded script. Even if the remote resource is not intentionally malicious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of your app.

To resolve this issue, it would be appropriate to remove all hidden features including hidden frameworks and codes in your app.

We hope you will consider making the necessary changes to be in compliance with the App Store Review Guidelines and will resubmit your revised app.

Please reply to this message via Resolution Center on App Store Connect or feel free to contact me at +1-669-283-4658 during weekdays, between 9AM - 5PM Pacific Time, if you need further clarification.

Best regards,
Jenny
App Store Review

----------------------完美的分割线-----------------------------------------------------------------
原因是检测出代码里面包含了这些关键字，可能creator代码的一些部分已经被标记，完全是看运气，如果不幸和我一样被关进小黑屋，那么就会进行严审，包括但不限于检测代码、资源等。所以第一次提审的时候，建议小伙伴们先去除一切热更相关代码，先过审再说，并不是其他小伙伴提出主要隐藏热更新界面。

1赞
#15

请问楼主，你们电话里有没有讨论过那些已经上线的有热更的游戏的情况？如果hotUpdate的关键字都不被允许，想象中岂不是所有有热更的游戏都无法过审了？这个感觉和现实情况很不符啊。

#16

这个应该是运气问题，我的APP正好被查到了，然后就进入了苹果审核的小黑屋，会检测你所有的代码以及资源

#17

这些命名不是都在c++吗。。。
这咋检测的。。。

#18

这个不太清楚，运气不好就会一直被针对，我把c++里面支持热更新的代码都用预编译屏蔽了，还是不行

#19

这不是js代码吗？ project.js 没用xxtea加密吗？:dog:

#20

打包时候使用了加密，但是好像这个JSON.parse(hotUpdateSearchPaths);代码是在main.js里面，main.js这个文件好像没有被加密到。

#21

用 UglifyJS 混淆下。应该能骗过去。

#22

"remoteManifestUrl” ,”remoteVersionUrl”这些关键字c++代码里面有，不知道他们是如何检测出来的，我都使用预编译屏蔽了。