mlkit icon indicating copy to clipboard operation
mlkit copied to clipboard

[Bug report] Foreign Domain Found in ML Kit TextRecognition SDK

Open HassanTaleb90 opened this issue 7 months ago • 0 comments

ENVIRONMENT

  • OS version: 15.4 (24E248)
  • ML Kit APIs and versions: 8.0.0

STEPS

  1. Install the latest ML Kit Text Recognition pod (GoogleMLKit/TextRecognition)
  2. Search for suspicious domains in the built frameworks using: grep -r "nic.ir.md"
  3. Observe that the domain nic.ir.md is present in the compiled binary for MLKitTextRecognitionCommon

EXPECTED

No hardcoded references to unrelated or suspicious domains such as nic.ir.md should exist in production ML Kit SDK binaries, especially when unrelated to the SDK’s functionality.

ACTUAL

A suspicious domain (nic.ir.md) is present in the compiled binary MLKitTextRecognitionCommon.framework. This raises compliance and privacy concerns, especially for apps being reviewed on the App Store.

https://issuetracker.google.com/issues/411157364

image image

HassanTaleb90 avatar Apr 18 '25 10:04 HassanTaleb90