iOS 27: “Malicious link blocked” for legitimate call forwarding codes

Question

Created 1d

Replies 1

Boosts 0

Participants 2

Hello!

I develop a voicemail app service and I use MMI codes to let users enable/disable call forwarding to their voicemail number.

For example, the app opens the Phone app with a code such as:

**21*<phone number>#

This is expected behavior and is required for the service to work.

However on iOS 27, those links are now blocked with a “Malicious link blocked” warning, saying that the link may forward incoming calls/messages.

Is there any supported way for apps with a legitimate use case like this to request an exemption, or otherwise avoid this warning?

Answer 1

DTS Engineer OP

Apple

2h

the app opens the Phone app with a code such as

Just to be clear, you open the Phone app by opening a tel URL, right?

If so, I’m not surprised by this change. Documentation on the tel URL scheme — well, on Apple’s support for the tel URL scheme — is thin on the ground, but I believe that Apple URL Scheme Reference > Phone Links is still the most up-to-date thing. And that doc says:

To prevent users from maliciously redirecting phone calls or changing the behavior of a phone or account, the Phone app supports most, but not all, of the special characters in the tel scheme. Specifically, if a URL contains the * or # characters, the Phone app does not attempt to dial the corresponding phone number.

Now, that’s a pretty hard-line stance, and the actual implementation has bounced around a bit over the years, but I’ve seen numerous problems in this space over the years.

those links are now blocked with a “Malicious link blocked” warning

So, completely blocked? That is, the user has no option to acknowledge this warning and continue anyway?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"