iOS 27: “Malicious link blocked” for legitimate call forwarding codes

Question

Created 4d

Replies 3

Boosts 0

Participants 2

Hello!

I develop a voicemail app service and I use MMI codes to let users enable/disable call forwarding to their voicemail number.

For example, the app opens the Phone app with a code such as:

**21*<phone number>#

This is expected behavior and is required for the service to work.

However on iOS 27, those links are now blocked with a “Malicious link blocked” warning, saying that the link may forward incoming calls/messages.

Is there any supported way for apps with a legitimate use case like this to request an exemption, or otherwise avoid this warning?

Answered by DTS Engineer in 901434022

there doesn’t seem to be any option for the user to acknowledge the warning and continue

OK.

Sadly, I don’t have any good answers for you. My only suggestion is that you file a bug about this. Make sure to give a high-level explanation of what your product does, and then explain the impact of this change of behaviour.

Please post your bug number, just for the record.

ps As you’ve learnt, it’s better to reply as a reply, rather than in the comments. See Quinn’s Top Ten DevForums Tips for more about that, and for a bunch of other titbits.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Answer 1

DTS Engineer OP

Apple

3d

the app opens the Phone app with a code such as

Just to be clear, you open the Phone app by opening a tel URL, right?

If so, I’m not surprised by this change. Documentation on the tel URL scheme — well, on Apple’s support for the tel URL scheme — is thin on the ground, but I believe that Apple URL Scheme Reference > Phone Links is still the most up-to-date thing. And that doc says:

To prevent users from maliciously redirecting phone calls or changing the behavior of a phone or account, the Phone app supports most, but not all, of the special characters in the tel scheme. Specifically, if a URL contains the * or # characters, the Phone app does not attempt to dial the corresponding phone number.

Now, that’s a pretty hard-line stance, and the actual implementation has bounced around a bit over the years, but I’ve seen numerous problems in this space over the years.

those links are now blocked with a “Malicious link blocked” warning

So, completely blocked? That is, the user has no option to acknowledge this warning and continue anyway?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Answer 2

Guglio95 OP

2d

Screenshot attached, there's no option to acknowledge and continue anyway

Answer 3

DTS Engineer OP

Apple

1d

Recommended

there doesn’t seem to be any option for the user to acknowledge the warning and continue

OK.

Sadly, I don’t have any good answers for you. My only suggestion is that you file a bug about this. Make sure to give a high-level explanation of what your product does, and then explain the impact of this change of behaviour.

Please post your bug number, just for the record.

ps As you’ve learnt, it’s better to reply as a reply, rather than in the comments. See Quinn’s Top Ten DevForums Tips for more about that, and for a bunch of other titbits.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"