Ionic app just kicked from android Google Playstore from non-compliant version of Cordova plugin App-update SDK

user_7211359 0
Viewed 1378

Just received this message from Playstore:

Your app contains content that doesn’t comply with the Malicious Behavior policy. We found your app is using a non-compliant version of Cordova plugin App-update SDK which contains code to download or install applications from unknown sources outside of Google Play.

There no more explanations in the Google mail except the fact that the app is suspended and removed from the store.

I pushed an updated apk recently which was running without problems for 2 years.

Just update some functions and update cordova plugins in my Ionic app.

Cordova App-update seem to be the latest version.

Here all the plugins I use:

cordova-android-play-services-gradle-release 3.0.0 "cordova-android-play-services-gradle-release"
cordova-android-support-gradle-release 2.1.0 "cordova-android-support-gradle-release"
cordova-open-native-settings 1.5.2 "Native settings"
cordova-plugin-android-permissions 1.0.2 "Permissions"
cordova-plugin-androidx 1.0.2 "cordova-plugin-androidx"
cordova-plugin-androidx-adapter 1.1.1 "cordova-plugin-androidx-adapter"
cordova-plugin-app-update 2.0.2 "AppUpdate"
cordova-plugin-app-version 0.1.9 "AppVersion"
cordova-plugin-appversion 1.0.0 "App Version"
cordova-plugin-camera 4.1.0 "Camera"
cordova-plugin-device 2.0.3 "Device"
cordova-plugin-file 6.0.2 "File"
cordova-plugin-file-opener2 3.0.2 "File Opener2"
cordova-plugin-file-transfer 1.7.1 "File Transfer"
cordova-plugin-firebasex 6.1.0 "Google Firebase Plugin"
cordova-plugin-globalization 1.11.0 "Globalization"
cordova-plugin-inappbrowser 3.2.0 "InAppBrowser"
cordova-plugin-ionic-webview 5.0.0 "cordova-plugin-ionic-webview"
cordova-plugin-keychain-touch-id 3.2.1 "TouchID and Keychain"
cordova-plugin-screen-orientation 3.0.2 "Screen Orientation"
cordova-plugin-splashscreen 5.0.4 "Splashscreen"
cordova-plugin-statusbar 2.4.3 "StatusBar"
cordova-plugin-uniquedeviceid 1.3.2 "UniqueDeviceID"
cordova-plugin-whitelist 1.3.4 "Whitelist"
cordova-sqlite-storage 5.0.0 "Cordova sqlite storage plugin - cordova-sqlite-storage plugin version"
cordova.plugins.diagnostic 5.0.1 "Diagnostic"
es6-promise-plugin 4.2.2 "Promise"
phonegap-plugin-barcodescanner 8.1.0 "BarcodeScanner"

Any idea?

cordova-plugins ionic-framework cordova
1 Answers

Your app contains cordova-plugin-app-update which contains code to directly download and install an APK at runtime.

This bypasses the Play Store which means a malicious app could potentially use it to install malware on the device.

For this reason, Google has rejected your app on security grounds. This practice has been outlawed for quite some time on the Play Store but it may be that Google has recently added automated tools to scan uploaded APKs for such code and hence why by merely making minor updates to your app, it has triggered its rejection.

TL;DR: remove cordova-plugin-app-update from your app, resumbit and you should be OK.

user_7772650
Related