react / react/react-native

Privacy manifest aggregation picks reasons restricted to third-party SDKs

未关闭
#45,852 3 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

Issue: Author Provided Repro
主要语言
C++
星标
127k
派生
25.3k
平均合并
1 天 23 小时
30 天内合并 PR
4

描述

Description

#44214 implemented a privacy manifest agregation mechanism, which would iterate through the privacy manifests from dependencies and add their required API reasons to the app privacy manifest.

However, according to the Apple documentation on privacy manifests, there are reasons that should only be used by third-party SDKs, such as 0A2A.1 and C56D.1. These reasons should not be copied into the app privacy manifest since the app is not a third-party SDK. Instead, the app developer should check which of the other reasons on the respective category applies to their usage of the third-party library.

So the aggregation mechanism should check if the reasons used in the privacy manifests from the dependencies are third-party exclusives. If they are, they should not be added to the app privacy manifest, and the developer could be prompted to pick other reasons.

Steps to reproduce
  1. Add a dependency whose privacy manifest declares a reason restricted to third-party SDKs, such as react-native-blob-util. That is already set up on the reproducer repo.
  2. On the ios directory, run bundle install + bundle exec pod install
  3. The PrivacyInfo.xcprivacy will be changed. It will have the 0A2A.1 reason on the NSPrivacyAccessedAPICategoryFileTimestamp, which is restricted to third-party SDKs
React Native Version

0.74.4

Affected Platforms

Runtime - iOS, Build - MacOS

Output of npx react-native info
System:
  OS: macOS 14.3
  CPU: (8) x64 Intel(R) Core(TM) i5-8257U CPU @ 1.40GHz
  Memory: 918.40 MB / 8.00 GB
  Shell:
    version: "5.9"
    path: /bin/zsh
Binaries:
  Node:
    version: 18.17.0
    path: ~/.local/share/nvm/v18.17.0/bin/node
  Yarn:
    version: 3.6.4
    path: /usr/local/bin/yarn
  npm:
    version: 9.6.7
    path: ~/.local/share/nvm/v18.17.0/bin/npm
  Watchman: Not Found
Managers:
  CocoaPods: Not Found
SDKs:
  iOS SDK:
    Platforms:
      - DriverKit 23.2
      - iOS 17.2
      - macOS 14.2
      - tvOS 17.2
      - visionOS 1.0
      - watchOS 10.2
  Android SDK: Not Found
IDEs:
  Android Studio: 2022.1 AI-221.6008.13.2211.9477386
  Xcode:
    version: 15.2/15C500b
    path: /usr/bin/xcodebuild
Languages:
  Java:
    version: 11.0.18
    path: /usr/bin/javac
  Ruby:
    version: 3.1.4
    path: /Users/gabrielguilhoto/.rvm/rubies/ruby-3.1.4/bin/ruby
npmPackages:
  "@react-native-community/cli": Not Found
  react:
    installed: 18.2.0
    wanted: 18.2.0
  react-native:
    installed: 0.74.4
    wanted: 0.74.4
  react-native-macos: Not Found
npmGlobalPackages:
  "*react-native*": Not Found
Android:
  hermesEnabled: true
  newArchEnabled: false
iOS:
  hermesEnabled: true
  newArchEnabled: false
Stacktrace or Logs
[Privacy Manifest Aggregation] Appending aggregated reasons to existing PrivacyInfo.xcprivacy file.
[Privacy Manifest Aggregation] Reading .xcprivacy files to aggregate all used Required Reason APIs.
Reproducer

https://github.com/gabrielguilhoto/rn-privacy-manifest-bug

Screenshots and Videos

No response

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue,再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库,在一个分支上完成修改。
  4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

调研方向

首先阅读 #44214 中的隐私清单聚合实现,然后在链接的 rn-privacy-manifest-bug 仓库中使用 bundle install 和 bundle exec pod install 重现该问题。当仅限于 third-party SDKs 的原因(例如 0A2A.1 和 C56D.1)不会被复制到应用的 PrivacyInfo.xcprivacy 中,同时其他依赖项的原因仍能正确聚合时,即表示完成。

由索引模型根据 Issue 内容生成。

评估

技术栈
ios, react-native, ruby
领域
build-system, mobile
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
45/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。