3

According to Apple allows hot code push in mobile apps, by Alice Yu in October 2014, the App Store reviewers allow code to be downloaded and run as long as it is:

  1. Not executable code, only interpreted.
  2. Downloaded and run by Apple's Webkit.
  3. A small change i.e doesn't change the purpose of the app.

These conditions have been used as a loophole by frameworks such as Meteor, Cordova/Phonegap & even the likes of Cocos2djs. While Meteor & Cordova are based on the iOS webview, they are downloaded and run via webkit, but Cocos2djs is based on spidermonkey and has the ability to update game content and scripts via Cocos2djs' "Asset Manager" i.e not webkit (webview).

So, what if code/scripts in languages other than javascript such as ruby, python or lua were sent as a "string" in a JSON file to be parsed WITHIN webkit (webview) and then passed to the interpreter to be executed? Would apple allow this as it is,

  1. Only interpreted code/scripts.
  2. Downloaded and INITIALLY run by Apple's Webkit before being sent to an interpreter for further execution.
  3. Making changes that do not change the purpose or intent of the app.
  • Welcome to Ask Different. I've removed the follow on question. Feel free to ask how to contact developer support as a second question if needed. – bmike Sep 3 '15 at 14:43
3

Apple's review team will reject your app if it looks capable of downloading executable code. They have erred on the side of rejecting apps that legitimately look like they will only even "interpret" the code since Apple stands far more to lose when third parties discover this path to executing code and inject the code between your web server and your app.

The stakes are too high - so you'll want to be very careful that you understand the risk to your app if you include this functionality.

The briefs app - which was submitted to the app store in Late 2009 I believe, was hung up in this "what is the difference between interpreted code, downloadable game data (think new levels for a game), executable code" review state until April 2013

Clearly, there are far more apps on the store that use interpreters so your path to approval is likely to be smoothed by the efforts and pain of the pioneers that got Apple used to the idea that they can ensure interpreted code and configuration doesn't turn into executables.

  • Thanks for the information @bmike. As I understand it, the briefs app is downloading binary data and not interpreted data like .py, .rb or .lua. Furthermore, instead of just sending data over a network directly to the app, these files would be unpacked (parsed) by Apple's Webview (in javascript) as json before sending the file to be interpreted by the VM. – Experimentas Sep 3 '15 at 16:47
  • Forgot to mention. It is like how someone could update their cordova app by modifying a native api available through javascript. – Experimentas Sep 3 '15 at 16:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .