My Android Application is getting rejected from PlayStore

Question

I am uploading my application in the Android PlayStore and it is getting rejected because of SMS permission in it, but in my Manifest.xml file, there is no SMS permission added.

After having a conversation with the Google team they said that there is permission available of SMS and I am unable to find it.

Below is the screenshot provided by the Google Team and it has SMS permission in there.

My Manifest file looks like this

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
    package="com.msonline.android">

    <uses-permission android:name="android.permission.READ_CONTACTS" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.READ_PHONE_STATE" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />

    <application
        android:name=".ApplicationClass"
        android:allowBackup="true"
        android:icon="@drawable/app_icon"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/MSOAppTheme"
        tools:ignore="AllowBackup,GoogleAppIndexingWarning"
        tools:replace="android:allowBackup,android:icon,android:label,android:theme">

//Other declarations of Activities

    </application>

</manifest>

Any Help is appreciable thanks in Advance.

Edit #1

build.gradle

    apply plugin: 'com.onesignal.androidsdk.onesignal-gradle-plugin'
apply plugin: 'com.android.application'
apply plugin: 'io.fabric'

android {
    compileSdkVersion 28
    defaultConfig {
        applicationId "package name"
        minSdkVersion 16
        targetSdkVersion 28
        versionCode 31
        versionName "4.0"
        testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
                    multiDexEnabled true
        vectorDrawables.useSupportLibrary = true
    }
    buildTypes {
        release {
            debuggable false
            shrinkResources true
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
        }
    }
    lintOptions {
        checkReleaseBuilds false
    }
}

dependencies {
    implementation fileTree(include: ['*.jar'], dir: 'libs')
    implementation 'com.android.support:appcompat-v7:28.0.0'
    implementation 'com.android.support:support-v4:28.0.0'
    implementation 'com.android.support.constraint:constraint-layout:1.1.3'
    implementation 'com.android.support:recyclerview-v7:28.0.0'
    testImplementation 'junit:junit:4.12'
    implementation 'com.android.support:design:28.0.0'
    implementation 'com.android.support:cardview-v7:28.0.0'
    implementation('com.crashlytics.sdk.android:crashlytics:2.7.1@aar') {
        transitive = true
    }
    implementation 'pub.devrel:easypermissions:1.3.0'
    implementation 'com.squareup.retrofit2:retrofit:2.5.0'
    implementation 'com.squareup.retrofit2:converter-gson:2.4.0'
    implementation 'com.squareup.okhttp3:logging-interceptor:3.8.1'
    implementation 'com.onesignal:OneSignal:3.10.3'
    implementation 'com.android.support:multidex:1.0.3'
    implementation 'com.google.firebase:firebase-config:16.4.1'
    implementation "com.google.firebase:firebase-core:16.0.8"
    implementation 'com.facebook.fresco:fresco:1.7.1'
    implementation 'com.squareup.picasso:picasso:2.71828'
    implementation('com.payumoney.sdkui:plug-n-play:1.0.0') {
        transitive = true;
        exclude module: 'payumoney-sdk'
    }
    implementation 'com.payumoney.core:payumoney-sdk:7.1.0'
//    implementation 'com.google.android.gms:play-services-ads:17.1.1'
    implementation 'com.google.android.gms:play-services-ads:17.2.0'
    implementation 'com.google.android.gms:play-services-location:16.0.0'


    implementation project(':libraryMobilePaymentSDKLive')
}
apply plugin: 'com.google.gms.google-services'

Manifest of Lib added

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.atom.library_mobilepaymentsdk"
android:versionCode="3"
android:versionName="3.3" >

<application
    android:allowBackup="true"
    android:icon="@drawable/process"
    android:label="atom payment SDK"
    android:theme="@android:style/Theme.Holo.Light" >
</application>

Answer 1

Third party libraries also contribute to your permission tree. In your case the below library that you are using is having RECEIVE_SMS declared in manifest.

com.payumoney.sdkui:plug-n-play:1.0.0

You can check the sdk manifest from sdk's git repo using below this link.

There is RECEIVE_SMS defined in manifest.

<uses-permission
        android:name="android.permission.RECEIVE_SMS"
android:protectionLevel="signature" />

What you can try to do is to remove this permission, first declare in your manifest tools:node="remove" then add

<uses-permission android:name="android.permission.RECEIVE_SMS" tools:node="remove" />

The final merged manifest will not have RECEIVE_SMS