iOS: allow opting out of the private-CoreSVG SVG decoder (exclude_files by default, or an opt-in flag)
维护者通常 2 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 68/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- ios, objective-c, react-native
- 领域
- build-system, mobile
调研方向
首先检查 podspec、ios/SVG/CoreSVG.mm、SvgDecoder.{h,mm} 以及 codegenConfig.ios.modulesConformingToProtocol 注册，以比较默认排除和 opt-in 方式。通过 pod install、iOS 构建，以及检查 SVG 解码器源文件和注册在默认情况下不存在但在启用后仍可用，来确认所选择的行为。
由索引模型根据 Issue 内容生成。
描述
Summary
ios/SVG/CoreSVG.mm reaches five private CoreSVG functions via dlsym, with the symbol names stored base64-encoded. SvgDecoder is then registered app-wide as an RCTImageDataDecoder through codegenConfig.ios.modulesConformingToProtocol, so this code is linked into and reachable from every app that installs the library — including apps that never render an SVG and use SF Symbols for their tab icons.
This is a hard blocker for us, and I suspect for other App Store publishers, so I would like to ask for a supported way to opt out rather than keep patching it locally.
Why it matters
App Store Review Guideline 2.5.1 is about use of private API and carries no obfuscation carve-out. Separately, the Apple Developer PLA distinguishes plain private-API use (§11.2(a), a curable breach with a 30-day cure period) from "hiding or trying to hide functionality from Apple's review" (§11.2(g), which is not). The base64 encoding is what moves this from the first category toward the second, and it was introduced upstream of here — SDWebImageSVGCoder's equivalent change is titled "Change to hidden the symbols and follows App Store Submit rule".
To be clear about what we did and did not find: we have no evidence of any rejection caused by this library, and there is a good deal of precedent for the obfuscated form passing review (expo-image ships the same construction transitively, at scale, and has for years). Our concern is not the likely case — it is that the unlikely case is not a resubmit.
It also cannot be avoided by configuration today. Choosing SF Symbols stops the private functions being called, but canDecodeImageData: is invoked for every image the app decodes, and +[CoreSVGWrapper isSVGData:] runs +initialize and all five dlsym lookups on first use. The symbols are in the binary either way.
What we are asking for
Either would fully solve it, and the first is a one-line change:
s.exclude_files = "ios/SVG/**/*"in the podspec by default, with an opt-in (subspec, or a$RNBottomTabsEnableSVGPodfile flag) for the apps that actually want SVG tab icons.- An opt-in flag for the whole SVG decoder, covering both the sources and the
codegenConfig.ios.modulesConformingToProtocolregistration.
Our reading is that most consumers do not use the SVG path at all, so defaulting it off costs those users nothing and removes the question from their review submission entirely.
What we are doing meanwhile
Carrying a patch-package patch against 1.4.0 that deletes ios/SVG/{CoreSVG,SvgDecoder}.{h,mm} and removes the modulesConformingToProtocol entry. Verified on RN 0.84 with the new architecture: pod install produces an identical pod count, the app builds, the generated imageDataDecoderClassNames array is empty, and a string scan of the linked binary finds zero occurrences of CoreSVGWrapper, SvgDecoder, CGSVGDocument, _imageWithCGSVGDocument or the base64 literals (with unrelated symbols from the same library present in the same image as controls). Nothing broke — the decoder only ever served SVG bytes handed to RN's image loader.
Happy to send this as a PR if the maintainers would like it in either shape.
Environment
[email protected],@bottom-tabs/[email protected]- React Native 0.84, new architecture enabled, iOS, CocoaPods, Xcode 26.6
- 主要语言
- TypeScript
- 星标
- 1.5k
- 派生
- 108
- 平均合并
- 22 小时 36 分钟
- 30 天内合并 PR
- 10
环境准备
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
callstack/react-native-bottom-tabs 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 75/100
callstack/react-native-bottom-tabs#593 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
callstack/react-native-bottom-tabs#560 ·
维护者通常 2 天内回复
-
难度 4/5 3-5 天 新手友好度 48/100
callstack/react-native-bottom-tabs#592 ·
维护者通常 2 天内回复
-
难度 4/5 3-5 天 新手友好度 68/100
callstack/react-native-bottom-tabs#591 · 1 条评论 ·
维护者通常 2 天内回复
-
难度 4/5 3-5 天 新手友好度 58/100
callstack/react-native-bottom-tabs#590 ·
维护者通常 2 天内回复
查看 callstack/react-native-bottom-tabs 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
melgarafael/DeskcommCRM#1812 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 84/100
prisma/prisma-cli#309 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
gregwebs/pi-quota-dispatcher#26 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
openwatersio/slackwater.xyz#124 ·
维护者通常 1 天内回复
-
agent-reported area/browser area/docs documentation good first issue hacktoberfest help wanted P2
难度 1/5 1 小时以内 新手友好度 90/100
维护者通常 2 天内回复