Call/SMS permission final warning email from Google Play for My React Native app

Viewed 3229

My application is developed in React Native and released on Playstore.

So first time when it's showing warning for RECEIVE_SMS

I have removed plugin related to this permission and also changed my working flow accordingly. And again uploaded updated apk to playstore.

Still I am getting final warning mail from Google play with below message:

In October 2018, we announced updates to our Permissions policy that will limit which apps are allowed to request Call Log and SMS permissions. This is the third and final reminder to let you know that this policy may impact one or more of your apps.

Starting January 9, 2019, only an app that has been selected as a user's default app for making calls or text messages, or whose core functionality is approved for one of the exception use cases, will be able to access Call Log or SMS permissions.

I have find all over the project, I am not getting RECEIVE_SMS permission in any of the plugin.

Here is my Manifest code:

<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
<uses-permission android:name="android.permission.VIBRATE" />
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
<uses-permission android:name="android.permission.WAKE_LOCK" />
<permission
        android:name="${applicationId}.permission.C2D_MESSAGE"
        android:protectionLevel="signature" />
<uses-permission android:name="${applicationId}.permission.C2D_MESSAGE" />

Here is the plugin I have used:

  "dependencies": {
    "lodash": "^4.17.10",
    "moment": "^2.22.2",
    "moment-duration-format": "^2.2.2",
    "prop-types": "^15.6.2",
    "react": "16.4.1",
    "react-native": "0.56.0",
    "react-native-actionsheet": "^2.4.2",
    "react-native-autocomplete-input": "^3.6.0",
    "react-native-background-timer": "^2.0.1",
    "react-native-check-box": "^2.1.0",
    "react-native-confirmation-code-input": "^1.0.4",
    "react-native-datepicker": "^1.7.2",
    "react-native-device-info": "^0.24.3",
    "react-native-dropdownalert": "^3.5.0",
    "react-native-fabric": "github:corymsmith/react-native-fabric#523a4edab3b2bf55ea9eeea2cf0dde82c5c29dd4",
    "react-native-firebase": "^4.3.8",
    "react-native-google-sign-in": "^1.0.16",
    "react-native-keyboard-aware-scroll-view": "^0.7.0",
    "react-native-material-dialog": "^0.7.4",
    "react-native-message-bar": "^2.0.10",
    "react-native-modal": "^6.5.0",
    "react-native-pages": "^0.7.0",
    "react-native-progress": "^3.5.0",
    "react-native-simple-radio-button": "^2.7.2",
    "react-native-snackbar": "^0.5.0",
    "react-native-social-auth": "^2.0.0",
    "react-native-splash-screen": "^3.1.1",
    "react-native-stars": "^1.1.5",
    "react-native-swiper": "^1.5.13",
    "react-native-tab-view": "^1.0.2",
    "react-native-toast": "^1.0.1",
    "react-native-vector-icons": "^5.0.0",
    "react-native-web-service-handler": "^1.0.2",
    "react-navigation": "^2.11.2"
  },

I am using below process to find permission:

  1. I have try to find this permission using all search methods using different tools and editors
  2. Also manually check all the plugins manifest files.
  3. Checked Manifest from build folder, after creating release apk.

Still I am not able to find the point,from where this permission including in apk.

So my questions are:

  1. How I can find from where this permission including into my apk?
  2. While using search Method, I am able to find RECEIVE_SMS permission in node_modules/react native/Libraries/PermissionAndroid Module. But I am not using or importing that class in my project. So is it creating problem?

How I can build apk without CALL/SMS permission and any debug method for React Native to check it?

4 Answers

We had the same problem. It turned out that we had a really old version of the app still active in the alpha channel. Removing that fixed the warning.

Full story: we were using the READ_SMS permission for login and then saw the blog post about new policies and decided to remove it as this usage was not compliant. Removed and updated the apk in Play Store. The first hint what something was wrong was when we were adding another feature and uploaded a new APK and got the warning about SMS and a form asking why are we using it. As we were not then we decided to answer that we are not compliant as we are not using the READ_SMS and thus do not need to be compliant. Today we git the final warning that we are still using READ_SMS permission and the app will be removed on 9th of March 2019 if this is not fixed. After investigation we found that the new APK and the release channel was and had been totally fine for a long time. But we had an active alpha release from two years ago which was still using the READ_SMS permission. After we deactivated it the warning went away immediately.

Please check below permissions .They are asking for SMS permission.

<permission
    android:name="${applicationId}.permission.C2D_MESSAGE"
    android:protectionLevel="signature" />

Try adding the following permission -

<uses-permission android:name="android.permission.RECEIVE_SMS" tools:node="remove" />

I also needed to write it line in manifest file of my app to get approved from google play store and my app is approved now.

Related