Urgent.News

What's breaking now, across thousands of outlets.

Monday, 2 November 2026 Reading Room

Tech

Serving Customer-Sent WhatsApp Media Safely: MIME Types, Filenames and the Blob URL Trap

A WhatsApp team inbox does something most web apps avoid: it shows files from strangers inside a logged-in session. Customers send photos, voice notes, PDFs and "documents" of any kind, and an agent opens them in the same browser tab that holds their access to every conversation in the account. If one of those files is served back the wrong way, it stops being a picture and becomes code running…

dev.to ·

WhatsApp's customer service inbox displays files from unknown sources within a logged-in browser tab. This includes photos, voice notes, PDFs, and various documents. Agents open these files in the same browser tab that grants them access to all account conversations. If served incorrectly, a file can become executable code running under that agent's control.

The focus of this article is on safely handling inbound WhatsApp media messages, determining what to trust, storage methods, and the necessary response headers for secure serving. The provided TypeScript snippets illustrate practical implementations of the discussed concepts, based on actual test cases.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

Understanding the Three Types of Programming Errors in C: Syntax, Logic, and Semantic Errors

Understanding the Three Types of Programming Errors in C: Syntax, Logic, and Semantic Errors When learning software development, one of the most important skills you need to develop is the ability to…

  • Syntax errors arise from violating C language grammar rules
  • Logic errors result in incorrect program outputs despite successful execution
  • Semantic errors involve invalid expressions or operations with meaningful code

·dev.to

Hallucination Is a Design Problem, Not a Model Problem

Most procurement conversations about hallucination open with the wrong question: which model hallucinates least? It is the wrong question because it treats a structural property as a vendor feature…

  • Hallucination stems from design, not model choice
  • Models trained to guess over uncertainty produce hallucinations
  • Abstaining when uncertain fixes design issue

·dev.to

A Cancel Save Offer Is a Price Discovery Moment

When a subscriber clicks cancel, they are usually telling you something before they tell you goodbye. The reason they give — too expensive, not using it, need a break, moving to a competitor — is the…

  • Cancel save offer provides feedback for pricing and product improvements
  • Tailor offer to specific reason for cancelling, not blanket discount
  • Match offer to user's concern: price, break, or switching to alternative

·dev.to

More from Monday 2 November →