Fix allowed origins

[mifi]

• escape regex in default companionAllowedHosts
• also fail early if invalid regex supplied
• and add unit tests

[github-actions]

Diff output files

diff --git a/packages/@uppy/companion-client/lib/Provider.js b/packages/@uppy/companion-client/lib/Provider.js
index 8be290a..8b5780b 100644
--- a/packages/@uppy/companion-client/lib/Provider.js
+++ b/packages/@uppy/companion-client/lib/Provider.js
@@ -6,6 +6,7 @@ var id = 0;
 function _classPrivateFieldLooseKey(e) {
   return "__private_" + id++ + "_" + e;
 }
+import { isOriginAllowed } from "./getAllowedHosts.js";
 import RequestClient, { authErrorStatusCode } from "./RequestClient.js";
 const getName = id => {
   return id.split("-").map(s => s.charAt(0).toUpperCase() + s.slice(1)).join(" ");
@@ -13,21 +14,6 @@ const getName = id => {
 function getOrigin() {
   return location.origin;
 }
-function getRegex(value) {
-  if (typeof value === "string") {
-    return new RegExp(`^${value}$`);
-  }
-  if (value instanceof RegExp) {
-    return value;
-  }
-  return undefined;
-}
-function isOriginAllowed(origin, allowedOrigin) {
-  const patterns = Array.isArray(allowedOrigin) ? allowedOrigin.map(getRegex) : [getRegex(allowedOrigin)];
-  return patterns.some(pattern =>
-    (pattern == null ? void 0 : pattern.test(origin)) || (pattern == null ? void 0 : pattern.test(`${origin}/`))
-  );
-}
 var _refreshingTokenPromise = _classPrivateFieldLooseKey("refreshingTokenPromise");
 var _getAuthToken = _classPrivateFieldLooseKey("getAuthToken");
 var _getPlugin = _classPrivateFieldLooseKey("getPlugin");
diff --git a/packages/@uppy/companion-client/lib/getAllowedHosts.js b/packages/@uppy/companion-client/lib/getAllowedHosts.js
index 9912fbf..45d2f1c 100644
--- a/packages/@uppy/companion-client/lib/getAllowedHosts.js
+++ b/packages/@uppy/companion-client/lib/getAllowedHosts.js
@@ -1,12 +1,40 @@
-export default function getAllowedHosts(hosts, url) {
-  if (hosts) {
-    if (typeof hosts !== "string" && !Array.isArray(hosts) && !(hosts instanceof RegExp)) {
-      throw new TypeError(`The option "companionAllowedHosts" must be one of string, Array, RegExp`);
+function escapeRegex(string) {
+  return string.replace(/[/\-\\^$*+?.()|[\]{}]/g, "\\$&");
+}
+function wrapInRegex(value) {
+  if (typeof value === "string") {
+    return new RegExp(`^${value}$`);
+  }
+  if (value instanceof RegExp) {
+    return value;
+  }
+  return undefined;
+}
+export default function getAllowedHosts(companionAllowedHosts, companionUrl) {
+  if (companionAllowedHosts) {
+    const validate = value => {
+      if (!(typeof value === "string" && wrapInRegex(value)) && !(value instanceof RegExp)) {
+        throw new TypeError(`The option "companionAllowedHosts" must be one of string, Array, RegExp`);
+      }
+    };
+    if (Array.isArray(companionAllowedHosts)) {
+      companionAllowedHosts.every(validate);
+    } else {
+      validate(companionAllowedHosts);
     }
-    return hosts;
+    return companionAllowedHosts;
   }
-  if (/^(?!https?:\/\/).*$/i.test(url)) {
-    return `https://${url.replace(/^\/\//, "")}`;
+  let ret = companionUrl;
+  if (/^(?!https?:\/\/).*$/i.test(ret)) {
+    ret = `https://${companionUrl.replace(/^\/\//, "")}`;
   }
-  return new URL(url).origin;
+  ret = new URL(ret).origin;
+  ret = escapeRegex(ret);
+  return ret;
+}
+export function isOriginAllowed(origin, allowedOrigin) {
+  const patterns = Array.isArray(allowedOrigin) ? allowedOrigin.map(wrapInRegex) : [wrapInRegex(allowedOrigin)];
+  return patterns.some(pattern =>
+    (pattern == null ? void 0 : pattern.test(origin)) || (pattern == null ? void 0 : pattern.test(`${origin}/`))
+  );
 }

[Murderlon]

e2e is failing and one comment. Otherwise LGTM

[Murderlon]

you override ret below with new URL(ret).origin as this todo comment wants so can we remove this?

[mifi]

right, good catch. i was afraid of doing it in case it was be a breaking change, but then i accidentally did it after all 🤦‍♂️ if you agree it's probably not a breaking change, i'll just keep it as it is now

[mifi]

I have now idea why it fails with this error. i haven't even touched any of those files

@parcel/core: Failed to resolve '@uppy/core' from 
'./e2e/clients/dashboard-aws-multipart/app.js'
  /home/runner/work/uppy/uppy/e2e/clients/dashboard-aws-multipart/app.js:1:22
  > 1 | import { Uppy } from '@uppy/core'
  >   |                      ^^^^^^^^^^^^
    2 | import Dashboard from '@uppy/dashboard'
    3 | import AwsS3Multipart from '@uppy/aws-s3-multipart'

[mifi]

All good things are 3 as we say in norway. 3rd run’s a success