Xamarin.Android and user downloadable executable code (.dll)

user_6656216 0
Viewed 263

I have a question regarding this bullet point of the Malicious Behavior policy.

  • Apps or SDKs that download executable code, such as dex files or native code, from a source other than Google Play.

    Does an app fall into that category if the user can use it to download and run .NET assemblies (IL) from the NuGet gallery? More specifically: Xamarin.Android bindings.
    .NET assemblies by themselves should fall into the "JavaScript" category or "code that runs in a virtual machine and has limited access to Android APIs".

    However Android bindings contain native executable code which can technically be considered potentially malicious. A simple example would be downloading a native binding like "Refractored.GifImageView". Which is just a convenient library.

    The app itself is an educational tool for C#. It compiles and runs user C# code on their device.
xamarin.android google-play android c#
2 Answers

Well this a first time well basically the malicious behavior policy says that

Apps or SDKs that download executable code, such as dex files or native code, from a source other than Google Play

But what you seem to be missing is that this policy applies when your application is downloading an exe i.e. an executable file.(Emphasis on the application)

Now when you talk about nuget packages your application is not downloading the nuget packages it is basically being downloaded by vs then when you make an apk it gets converted into a Java Android Executable i.e. the APK now this apk is not downloading anything in app its already downloaded and bundled in so "the malicious behavior" policy doesn't apply at all in your scenario.

I hope it helps, Revert in case of queries

user_74620310

I don't speak for Google Play policy but I think it is extremely unlikely this would be allowed. Google Play has this policy to protect Android users from malicious code. Making app developers put all their code in the APK has two advantages:

  • it allows Google's abuse teams to look for malware before the app is published, so protect users
  • it prevents developers from having accidental security holes, where an attacked could attack the network or the server, and create arbitrary code for a user to execute on the device, even if the original developer did not intend anything malicious. App developers have made lots of mistakes in this area in the past.

Downloading arbitrary packages from NuGet at runtime sounds like it would be extremely dangerous from both counts, and so I suspect Google Play Policy won't allow it.

Have you considered the new Google Play feature dynamic delivery to accomplish what you want?

user_76354710
Related