From bc54aeb3f55df2fd7a0dd76cb9e52da5e8a1c200 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9e=20Kooi?= <renee@kooi.me>
Date: Wed, 26 May 2021 10:28:40 +0200
Subject: [PATCH] companion: support relative redirect URLs in responses
 (#2901)

---
 .../@uppy/companion/src/server/helpers/request.js  | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/packages/@uppy/companion/src/server/helpers/request.js b/packages/@uppy/companion/src/server/helpers/request.js
index 983cbae50..78b1c082b 100644
--- a/packages/@uppy/companion/src/server/helpers/request.js
+++ b/packages/@uppy/companion/src/server/helpers/request.js
@@ -79,15 +79,21 @@ function isPrivateIP (ipAddress) {
 
 module.exports.FORBIDDEN_IP_ADDRESS = FORBIDDEN_IP_ADDRESS
 
-module.exports.getRedirectEvaluator = (requestURL, blockPrivateIPs) => {
-  const { protocol } = new URL(requestURL)
+module.exports.getRedirectEvaluator = (rawRequestURL, blockPrivateIPs) => {
+  const requestURL = new URL(rawRequestURL)
   return (res) => {
     if (!blockPrivateIPs) {
       return true
     }
 
-    const redirectURL = res.headers.location
-    const shouldRedirect = redirectURL ? new URL(redirectURL).protocol === protocol : false
+    let redirectURL = null
+    try {
+      redirectURL = new URL(res.headers.location, requestURL)
+    } catch (err) {
+      return false
+    }
+
+    const shouldRedirect = redirectURL.protocol === requestURL.protocol
     if (!shouldRedirect) {
       logger.info(
         `blocking redirect from ${requestURL} to ${redirectURL}`, 'redirect.protection'