@uppy/companion: Getkey safe behavior (#3592)

* add warning about default getKey

* add env variable to get a safer getKey default

COMPANION_S3_GETKEY_SAFE_BEHAVIOR

packages/@uppy/companion/src/companion.js

@@ -63,6 +63,10 @@ module.exports.app = (optionsArg = {}) => {
   validateConfig(optionsArg)
 
   const options = merge({}, defaultOptions, optionsArg)
+
+  // todo remove in next major and default to the safer getKey instead
+  if (options.providerOptions.s3.getKey === defaultOptions.providerOptions.s3.getKey) process.emitWarning('The current default getKey implementation is not safe because it will cause files with the same name to be overwritten and should be avoided. Please use the environment variable COMPANION_S3_GETKEY_SAFE_BEHAVIOR=true (standalone) or provide your own getKey implementation instead')
+
   const providers = providerManager.getDefaultProviders()
   const searchProviders = providerManager.getSearchProviders()
   providerManager.addProviderOptions(options, grantConfig)

packages/@uppy/companion/src/standalone/helper.js

@@ -2,6 +2,8 @@ const fs = require('fs')
 const merge = require('lodash.merge')
 const stripIndent = require('common-tags/lib/stripIndent')
 const crypto = require('crypto')
+const uuid = require('uuid') // TODO: migrate to `crypto.getRandomUUID` when removing support for Node.js <14.
+
 const utils = require('../server/helpers/utils')
 const logger = require('../server/logger')
 // @ts-ignore
@@ -27,7 +29,7 @@ const getConfigFromEnv = () => {
   const domains = process.env.COMPANION_DOMAINS || process.env.COMPANION_DOMAIN || null
   const validHosts = domains ? domains.split(',') : []
 
-  return {
+  const envConfig = {
     providerOptions: {
       drive: {
         key: process.env.COMPANION_GOOGLE_KEY,
@@ -117,6 +119,13 @@ const getConfigFromEnv = () => {
     clientSocketConnectTimeout: process.env.COMPANION_CLIENT_SOCKET_CONNECT_TIMEOUT
       ? parseInt(process.env.COMPANION_CLIENT_SOCKET_CONNECT_TIMEOUT, 10) : undefined,
   }
+
+  // todo remove COMPANION_S3_GETKEY_SAFE_BEHAVIOR in next major and use this getKey implementation instead by default
+  if (process.env.COMPANION_S3_GETKEY_SAFE_BEHAVIOR === 'true') {
+    envConfig.providerOptions.s3.getKey = (req, filename) => `${uuid.v4()}-${filename}`
+  }
+
+  return envConfig
 }
 
 /**