From d11dae4c5ddf4e390e30e877d907346c52e91086 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9e=20Kooi?= Date: Mon, 8 Oct 2018 15:31:31 +0200 Subject: [PATCH 1/3] Auto configure the serverPattern when using Transloadit's hosted Companion service. --- packages/@uppy/transloadit/src/index.js | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/packages/@uppy/transloadit/src/index.js b/packages/@uppy/transloadit/src/index.js index 36c4de6be..07cee72cb 100644 --- a/packages/@uppy/transloadit/src/index.js +++ b/packages/@uppy/transloadit/src/index.js @@ -15,6 +15,8 @@ function defaultGetAssemblyOptions (file, options) { } const COMPANION = 'https://api2.transloadit.com/companion' +// Regex matching acceptable postMessage() origins for authentication feedback from companion. +const ALLOWED_COMPANION_PATTERN = /\.transloadit\.com$/ // Regex used to check if a Companion address is run by Transloadit. const TL_COMPANION = /https?:\/\/api2(?:-\w+)?\.transloadit\.com\/companion/ const TL_UPPY_SERVER = /https?:\/\/api2(?:-\w+)?\.transloadit\.com\/uppy-server/ @@ -116,16 +118,18 @@ module.exports = class Transloadit extends Plugin { this.uppy.log(err) throw err } + if (file.remote && TL_COMPANION.test(file.remote.serverUrl)) { - let newHost = status.companion_url + const newHost = status.companion_url .replace(/\/$/, '') - let path = file.remote.url + const path = file.remote.url .replace(file.remote.serverUrl, '') .replace(/^\//, '') remote = { ...file.remote, serverUrl: newHost, + serverPattern: ALLOWED_COMPANION_PATTERN, url: `${newHost}/${path}` } } From 3c605d1ab9f44266dedabc6403fc17f342145fde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9e=20Kooi?= Date: Mon, 8 Oct 2018 15:49:11 +0200 Subject: [PATCH 2/3] transloadit: Add COMPANION_PATTERN constant. --- packages/@uppy/transloadit/src/index.js | 2 +- website/src/docs/transloadit.md | 19 +++++++++++++++++++ website/src/examples/transloadit/app.es6 | 6 +++++- 3 files changed, 25 insertions(+), 2 deletions(-) diff --git a/packages/@uppy/transloadit/src/index.js b/packages/@uppy/transloadit/src/index.js index 07cee72cb..6b1b1b1db 100644 --- a/packages/@uppy/transloadit/src/index.js +++ b/packages/@uppy/transloadit/src/index.js @@ -129,7 +129,6 @@ module.exports = class Transloadit extends Plugin { remote = { ...file.remote, serverUrl: newHost, - serverPattern: ALLOWED_COMPANION_PATTERN, url: `${newHost}/${path}` } } @@ -699,3 +698,4 @@ module.exports = class Transloadit extends Plugin { module.exports.COMPANION = COMPANION module.exports.UPPY_SERVER = COMPANION +module.exports.COMPANION_PATTERN = ALLOWED_COMPANION_PATTERN diff --git a/website/src/docs/transloadit.md b/website/src/docs/transloadit.md index 0daf4c735..eef563b36 100644 --- a/website/src/docs/transloadit.md +++ b/website/src/docs/transloadit.md @@ -55,6 +55,7 @@ const Transloadit = require('@uppy/transloadit') uppy.use(Dropbox, { serverUrl: Transloadit.COMPANION + serverPattern: Transloadit.COMPANION_PATTERN }) ``` @@ -66,6 +67,24 @@ uppy.use(Dropbox, { }) ``` +### `Transloadit.COMPANION_PATTERN` + +A RegExp pattern matching Transloadit's hosted companion endpoints. The pattern is used in remote provider `serverPattern` options, to ensure that third party authentication messages cannot be faked by an attacker's page, but can only originate from Transloadit's servers. + +Use it whenever you use `serverUrl: Transloadit.COMPANION`, like so: + +```js +const Dropbox = require('@uppy/dropbox') +const Transloadit = require('@uppy/transloadit') + +uppy.use(Dropbox, { + serverUrl: Transloadit.COMPANION + serverPattern: Transloadit.COMPANION_PATTERN +}) +``` + +The value of this constant covers _all_ Transloadit's Companion servers, so it does not need to be changed if you are using a custom [`service`](#service) option. However, if you are not using the Transloadit Companion servers at `*.transloadit.com`, make sure to set the `serverPattern` option to something that matches what you do use. + ## Options The `@uppy/transloadit` plugin has the following configurable options: diff --git a/website/src/examples/transloadit/app.es6 b/website/src/examples/transloadit/app.es6 index 8715f1c08..833f423b4 100644 --- a/website/src/examples/transloadit/app.es6 +++ b/website/src/examples/transloadit/app.es6 @@ -57,7 +57,11 @@ function initUppy () { target: '#uppy-dashboard-container', note: 'Images only, 1–2 files, up to 1 MB' }) - .use(Instagram, { target: Dashboard, serverUrl: 'https://api2.transloadit.com/companion', serverPattern: /\.transloadit\.com$/ }) + .use(Instagram, { + target: Dashboard, + serverUrl: 'https://api2.transloadit.com/companion', + serverPattern: Transloadit.COMPANION_PATTERN + }) .use(Webcam, { target: Dashboard }) uppy From 3160dcd4eb18abf2dab674087fd08c35901db911 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9e=20Kooi?= Date: Mon, 15 Oct 2018 13:07:49 +0200 Subject: [PATCH 3/3] transloadit: Tell user to set serverPattern when setting serverUrl. --- website/src/docs/transloadit.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/website/src/docs/transloadit.md b/website/src/docs/transloadit.md index eef563b36..f497eca41 100644 --- a/website/src/docs/transloadit.md +++ b/website/src/docs/transloadit.md @@ -59,6 +59,8 @@ uppy.use(Dropbox, { }) ``` +When using `Transloadit.COMPANION`, you should also configure [`serverPattern: Transloadit.COMPANION_PATTERN`](#Transloadit-COMPANION-PATTERN). + The value of this constant is `https://api2.transloadit.com/companion`. If you are using a custom [`service`](#service) option, you should also set a custom host option in your provider plugins, by taking a Transloadit API url and appending `/companion`: ```js