My Android Application is getting rejected from PlayStore

Question

I am uploading my application in the Android PlayStore and it is getting rejected because of SMS permission in it, but in my Manifest.xml file, there is no SMS permission added.

After having a conversation with the Google team they said that there is permission available of SMS and I am unable to find it.

Below is the screenshot provided by the Google Team and it has SMS permission in there.

My Manifest file looks like this

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
    package="com.msonline.android">

    <uses-permission android:name="android.permission.READ_CONTACTS" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.READ_PHONE_STATE" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />

    <application
        android:name=".ApplicationClass"
        android:allowBackup="true"
        android:icon="@drawable/app_icon"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/MSOAppTheme"
        tools:ignore="AllowBackup,GoogleAppIndexingWarning"
        tools:replace="android:allowBackup,android:icon,android:label,android:theme">

//Other declarations of Activities

    </application>

</manifest>

Any Help is appreciable thanks in Advance.

Edit #1

build.gradle

    apply plugin: 'com.onesignal.androidsdk.onesignal-gradle-plugin'
apply plugin: 'com.android.application'
apply plugin: 'io.fabric'

android {
    compileSdkVersion 28
    defaultConfig {
        applicationId "package name"
        minSdkVersion 16
        targetSdkVersion 28
        versionCode 31
        versionName "4.0"
        testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
                    multiDexEnabled true
        vectorDrawables.useSupportLibrary = true
    }
    buildTypes {
        release {
            debuggable false
            shrinkResources true
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
        }
    }
    lintOptions {
        checkReleaseBuilds false
    }
}

dependencies {
    implementation fileTree(include: ['*.jar'], dir: 'libs')
    implementation 'com.android.support:appcompat-v7:28.0.0'
    implementation 'com.android.support:support-v4:28.0.0'
    implementation 'com.android.support.constraint:constraint-layout:1.1.3'
    implementation 'com.android.support:recyclerview-v7:28.0.0'
    testImplementation 'junit:junit:4.12'
    implementation 'com.android.support:design:28.0.0'
    implementation 'com.android.support:cardview-v7:28.0.0'
    implementation('com.crashlytics.sdk.android:crashlytics:2.7.1@aar') {
        transitive = true
    }
    implementation 'pub.devrel:easypermissions:1.3.0'
    implementation 'com.squareup.retrofit2:retrofit:2.5.0'
    implementation 'com.squareup.retrofit2:converter-gson:2.4.0'
    implementation 'com.squareup.okhttp3:logging-interceptor:3.8.1'
    implementation 'com.onesignal:OneSignal:3.10.3'
    implementation 'com.android.support:multidex:1.0.3'
    implementation 'com.google.firebase:firebase-config:16.4.1'
    implementation "com.google.firebase:firebase-core:16.0.8"
    implementation 'com.facebook.fresco:fresco:1.7.1'
    implementation 'com.squareup.picasso:picasso:2.71828'
    implementation('com.payumoney.sdkui:plug-n-play:1.0.0') {
        transitive = true;
        exclude module: 'payumoney-sdk'
    }
    implementation 'com.payumoney.core:payumoney-sdk:7.1.0'
//    implementation 'com.google.android.gms:play-services-ads:17.1.1'
    implementation 'com.google.android.gms:play-services-ads:17.2.0'
    implementation 'com.google.android.gms:play-services-location:16.0.0'


    implementation project(':libraryMobilePaymentSDKLive')
}
apply plugin: 'com.google.gms.google-services'

Manifest of Lib added

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.atom.library_mobilepaymentsdk"
android:versionCode="3"
android:versionName="3.3" >

<application
    android:allowBackup="true"
    android:icon="@drawable/process"
    android:label="atom payment SDK"
    android:theme="@android:style/Theme.Holo.Light" >
</application>

Post your build.gradle file. Perhaps some of the dependencies add SMS permission. — atarasenko, May 16 '19 at 07:34
I don't get what you are asking. Google says to add ``. Your manifest still doesn't have it. Why did you not add it? — The Vee, May 16 '19 at 07:35
@TheVee: I don't want to add the SMS permission as there is no need of it now, and I did remove the permission from my Manifest file, but somehow it is displaying to the Google Team and because of it the application is getting rejected — Rakshit Nawani, May 16 '19 at 07:36
Please check manifest in final release apk. While creating final apk, gradle will merge manifests of app and libraries. — shivam gupta, May 16 '19 at 07:45

score 6 · Accepted Answer · edited May 16 '19 at 08:23

Third party libraries also contribute to your permission tree. In your case the below library that you are using is having RECEIVE_SMS declared in manifest.

com.payumoney.sdkui:plug-n-play:1.0.0

You can check the sdk manifest from sdk's git repo using below this link.

There is RECEIVE_SMS defined in manifest.

<uses-permission
        android:name="android.permission.RECEIVE_SMS"
android:protectionLevel="signature" />

What you can try to do is to remove this permission, first declare in your manifest tools:node="remove" then add

<uses-permission android:name="android.permission.RECEIVE_SMS" tools:node="remove" />

The final merged manifest will not have RECEIVE_SMS

This helped me, Please also add the below code which will remove the permission from the release build, so because of this code I don't need to contact the SDK Vendor — Rakshit Nawani, May 16 '19 at 07:55

score 2 · Answer 2 · edited May 16 '19 at 07:56

2

Surely you are using a third party library that add this permission. What you can try to do is to remove this permission, first declare in your manifest tools:node="remove" then add

<uses-permission android:name="android.permission.RECEIVE_SMS" tools:node="remove" />

The final merged manifest will not have RECEIVE_SMS

edited May 16 '19 at 07:56

Sergey Glotov

20,200
11
84
98

answered May 16 '19 at 07:53

Alessandro Verona

1,157
9
23

My Android Application is getting rejected from PlayStore

2 Answers2