aws-s3-multipart: Self-signed request does NOT escape path according to RFC 3986

[hiromi2424]

Initial checklist

• I understand this is a bug report and questions should be posted in the Community Forum
• I searched issues and couldn’t find anything (or linked relevant results below)

Link to runnable example

https://github.com/transloadit/uppy/tree/main/packages/%40uppy/companion

Steps to reproduce

Very simple to say one phrase, this is reproduced by using AWS-S3-Multipart with companionUrl and getTemporarySecurityCredentials :true options.

Runnable example will be produced by @uppy/companion server with making setup s3-multipart, S3 CORS-policy and sts federation permission.

Note that default key implementation makes key including filename so that special chars in name of uploading file causes error.

https://github.com/transloadit/uppy/blob/main/packages/%40uppy/companion/src/server/helpers/utils.js#L149
${crypto.randomUUID()}-${filename}

After above setup, try upload file with special chars in file name. (Example: !'()*.txt)

Expected behavior

• The chars "!'()*" is escaped in URL path
• The chars "!'()*" is escaped in URL query
• Signed request succeed

Actual behavior

• The chars "!'()*" is NOT escaped in URL path
• The chars "!'()*" is NOT escaped in URL query
• Signed request fails

[hiromi2424]

I will send PR to fix this and may include info what is a difference between uppy's implementation and AWS SDK's one.

[aduh95]

I'm not sure RFC 3986 requires escaping those characters, but I suppose that hardly matters if AWS requires it.