React-native-permissions: Permission using in list which is not used

Created on 5 Dec 2017 · 6Comments · Source: zoontek/react-native-permissions

Envuironment: iOS

React-Native version :0.47
Platform: iO
Device: all
OS version :all
react-native-permissions version: 1.0.3
Devtools: Xcode

In notes it written:
App Store submission disclaimer

If you need to submit you application to the AppStore, you need to add to your Info.plist all *UsageDescription keys with a string value explaining to the user how the app uses this data. Even if you don't use them.

It is security concern, though we are not required permission other then location we need to add in info.plist while making build for uploading to iTunes.

Source

Dhrupal

All 6 comments

Why is this a security concern?

zoontek on 6 Dec 2017

@Dhrupal I am not sure what do you mean by security concern. it seems that in your code or in your xcode build setting, you are requesting a specific permission but not adding it into info.plist or there is no description for that specific permission. This is required for Xcode 8 and above. If you are not specifying any description on info.plist your app will get rejected.

sergioutama on 6 Dec 2017

My concern is though i am not using bluethooth then also i need to add in info.plist.

Dhrupal on 7 Dec 2017

@sergioutama :your app will get rejected. This is my concern

Dhrupal on 7 Dec 2017

So it's not a security issue.
This module internal call code to all possible permissions. So if you app use it, you need to add those into the Info.plist, otherwise the iTunes connect (bot?) will find it and will tell you did not prepare your app correctly.
It's a requirement for this module to work as expected without getting your app rejected.
If you don't use some perms, no big deal for apple or you.
If you are not happy with this module, then don't use it. If we would like to not make this a problem, we might create multiple packages, with multiples libs in order to avoid the problem. Not sure we want that for maintenance.

MoOx on 7 Dec 2017

😕2 👎1 👍1

This is not a security issue, if your app does not request the permission to Apple it just means you are not using it. This package is very useful because it create a single package that handles all the permissions. If you dont request them, your users won't even notice anything. Please close this issue, the title is very misleading.