Downloading Javascript for execution in UIWebView versus JavascriptCore

Apple updated the policy which explicitly allows JavascriptCore to download and run javascript.

Here's the latest

3.3.2 An Application may not download or install executable code. Interpreted code may only be used in an Application if all scripts, code and interpreters are packaged in the Application and not downloaded. The only exception to the foregoing is scripts and code downloaded and run by Apple's built-in WebKit framework or JavascriptCore, provided that such scripts and code do not change the primary purpose of the Application by providing features or functionality that are inconsistent with the intended and advertised purpose of the Application as submitted to the App Store.

You may now choose freely wether to use UIWebView/WKWebView or JavascriptCore.

JavaScriptCore believes itself to be part of the WebKit framework per the domain hosting its documentation and is named as part of WebKit by Wikipedia. JavaScriptCore.framework is a separate file on disk but there is no WebKit.framework. One of the files in that framework is named 'WebKitAvailability.h' and defines preprocessor macros like WEBKIT_VERSION_4_0 and a bunch of things that WebKit uses to mark functions as available only in certain versions, indicating that the header is used to signify WebKit availability rather than to test for it.

So on the balance of probabilities I'd argue that JavaScriptCore is part of the WebKit framework.

Is JavaScript core considered part of the WebKit framework

There are two implementations of JavascriptCore. One is embedded in Webkit and runs only via a Webview. The second is in the JavascriptCore.framework and runs indepently of Webkit and can communication with every object in an app except a Webview.

It's clearly a security firewall. It would be madness to set up a system in which arbitrary Javascript executing in a webpage could directly program the app itself. Microsoft made a mistake pretty close to that circa 2000 IIRC. There was also around that time a little Applescript that would let you trigger Applescripts via Javascript on a webpage. It was intended for server admins to make remote admin pages but it blew open the security entirely. One, wrong line in any of the scripts and a black hat owned your machine.

I think the key phrase in the license is:

An Application may not download or install executable code...[emp added]

It's the possibility that the app can modify its function without user knowledge that causes the threat. However, if the user wants to manually direct an app to download a script and then run it in the JavascriptCore.framework, I don't think that would be a problem.

It's analogous to the app sandbox on the map. Apps are restricted by their entitlements in what files they reach automatically and without the user's knowledge. But, if the user manually uses Powerbox to choose files and locations, then the app can access any file the user choose. Likewise, if the user chooses to download and execute a script, separate from a Webview, then I doubt there is a problem.

I'd talk to Apple Developer Relations and get a direct answer before burning any time on a function that might get rejected. They're highly responsive in my experience.

I don't know the answer but this is too long to put in the comments section.

I'm reading the Ray Wenderlich iOS7 by tutorials book and in there it says:

"Note there are two things you cannot use JavaScript for: downloading and executing JavaScript code from a remote server ….that is against the iOS Developer Program agreement section 3.3.2".

But as can be seen above section 3.3.2 says:

"The only exception to the foregoing is scripts and code downloaded and run by Apple's builtin WebKit framework".

Which suggests if you download JavaScript as part of a page loaded by and executed by UIWebView then it is permitted. So seems to be in contradiction to the Ray Wenderlich quote, or is it. That's probably just the author's opinion, I doubt if anybody knows definitively what the exact situation is here regarding Javascript and if there's any difference between using UIWebView and JavaScriptCore.

Now if JavaScriptCore is considered part of WebKit how does the precise wording of the phrase from 3.3.2 "scripts and code downloaded and run by" come into play.

Is it the downloaded part, or the run by part, or both the downloaded and run by part. Or the wording is irrelevant because Apple make things as vague as they can seemingly on purpose.

But how would Apple ever know that your app downloaded javascript? If your app downloads content for display in a UIWebVIew how would they know its not just downloading plain old html. They can't know. So if Javascript can't be downloaded and executed then in order to enforce that Apple would have to say they are banning apps the BOTH download stuff, any stuff, AND use a UIWebView. Otherwise how could they possible enforce a ban?

Its all crazy.