3 ms·

The permission is within a XML comment so how sure are you that this would be caught as part of app store review? Since apps now auto-update each night any one

The permission is within a XML comment so how sure are you that this would be caught as part of app store review? Since apps now auto-update each night any one of your apps could theoretically add this code tonight couldn't they?

mike_d 7y ago
Apple knows how entitlements work and scan every release you try to upload for distribution. The app bundle is signed with an Apple signing key when it goes live, so you can't just randomly change the file once it is on the device.
- saagarjha 7y ago
  Evidently Apple does not know how they work, as their multiple parsers can’t get them right ;)
- nwsm 7y ago
  If their scan included an XML parser with the same flaw as CFPropertyListCreateWithData, then yes you could get it published without them noticing.
neximo64 7y ago
Apple tracks every time you change it and manually reviews it. In even more sophisticated means after what Uber did.
- saagarjha 7y ago
  Note that Uber was given that entitlement by Apple. It was explicitly granted an exception to use a private entitlement (which is in of itself unusual) and then submit such an app to the App Store.
- aeternum 7y ago
  Apple's XML parsers apparently are not catching this due to the comment trick. So the security relies on a human catching it. There are many ways to hide text from a human, IE padding it out with whitespace, character encoding tricks, etc.