Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

enforce usage of uploadUrls #3965

Merged
merged 1 commit into from Aug 10, 2022
Merged

enforce usage of uploadUrls #3965

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 2 additions & 1 deletion packages/@uppy/companion/src/config/companion.js
View file
Open in desktop
Expand Up @@ -99,7 +99,8 @@ const validateConfig = (companionOptions) => {
}

if (companionOptions.uploadUrls == null || companionOptions.uploadUrls.length === 0) {
logger.warn('Running without uploadUrls specified is a security risk if running in production', 'startup.uploadUrls')
if (process.env.NODE_ENV === 'production') throw new Error('uploadUrls is required')
logger.error('Running without uploadUrls is a security risk and Companion will refuse to start up when running in production (NODE_ENV=production)', 'startup.uploadUrls')
}

if (periodicPingUrls != null && (
Expand Down
4 changes: 2 additions & 2 deletions website/src/docs/companion.md
View file
Open in desktop
Expand Up @@ -357,9 +357,9 @@ const options = {

1. **filePath(required)** - Full path to the directory to which provider files will be downloaded temporarily.

2. **secret(recommended)** - A secret string which Companion uses to generate authorization tokens. You should generate a long random string for this.
2. **uploadUrls(required)** - An allowlist (array) of strings (exact URLs) or regular expressions. Companion will only accept uploads to these URLs. This ensures that your Companion instance is only allowed to upload to your trusted servers and prevents [SSRF](https://en.wikipedia.org/wiki/Server-side_request_forgery) attacks.

3. **uploadUrls(recommended)** - An allowlist (array) of strings (exact URLs) or regular expressions. If specified, Companion will only accept uploads to these URLs. This is needed to make sure a Companion instance is only allowed to upload to your servers. **Omitting this leaves your system open to potential [SSRF](https://en.wikipedia.org/wiki/Server-side_request_forgery) attacks, and may throw an error in future `@uppy/companion` releases.**
3. **secret(recommended)** - A secret string which Companion uses to generate authorization tokens. You should generate a long random string for this.

4. **redisUrl(optional)** - URL to running Redis server. If this is set, the state of uploads would be stored temporarily. This helps for resumed uploads after a browser crash from the client. The stored upload would be sent back to the client on reconnection.

Expand Down