@uppy/companion: change `COMPANION_ENABLE_URL_ENDPOINT` default (#5198)

docs/companion.md

@@ -651,8 +651,8 @@ as well as
 
 #### `enableUrlEndpoint` `COMPANION_ENABLE_URL_ENDPOINT`
 
-Set this to `false` to disable the
-[URL functionalily](https://uppy.io/docs/url/). Default: `true`.
+Set this to `true` to enable the [URL functionalily](https://uppy.io/docs/url/).
+Default: `false`.
 
 ### Events
 

docs/guides/migration-guides.md

@@ -9,6 +9,9 @@ These cover all the major Uppy versions and how to migrate to them.
 - `COMPANION_REDIS_EXPRESS_SESSION_PREFIX` now defaults to `companion-session:`
   (before `sess:`). To revert keep backwards compatibility, set the environment
   variable `COMPANION_REDIS_EXPRESS_SESSION_PREFIX=sess:`.
+- The URL endpoint (used by the `Url`/`Link` plugin) is now turned off by
+  default and must be explicitly enabled with
+  `COMPANION_ENABLE_URL_ENDPOINT=true` or `enableUrlEndpoint: true`.
 
 ## Migrate from Robodog to Uppy plugins
 

docs/sources/companion-plugins/url.mdx

@@ -90,8 +90,8 @@ new Uppy()
 
 ### Use in Companion
 
-Companion supports this plugin out-of-the-box so integration is required on this
-side.
+Companion supports this plugin out-of-the-box, however it must be enabled in
+Companion with the `enableUrlEndpoint` / `COMPANION_ENABLE_URL_ENDPOINT` option.
 
 ## API
 

e2e/start-companion-with-load-balancer.mjs

@@ -65,6 +65,7 @@ const startCompanion = ({ name, port }) => {
       COMPANION_SECRET: 'development', // multi instance will not work without secret set
       COMPANION_PREAUTH_SECRET: 'development', // multi instance will not work without secret set
       COMPANION_ALLOW_LOCAL_URLS: 'true',
+      COMPANION_ENABLE_URL_ENDPOINT: 'true',
       COMPANION_LOGGER_PROCESS_NAME: name,
     },
   })

packages/@uppy/companion/src/config/companion.js

@@ -16,7 +16,7 @@ const defaultOptions = {
     getKey: defaultGetKey,
     expires: 800, // seconds
   },
-  enableUrlEndpoint: true, // todo next major make this default false
+  enableUrlEndpoint: false,
   allowLocalUrls: false,
   periodicPingUrls: [],
   streamingUpload: false,

packages/@uppy/companion/src/standalone/helper.js

@@ -137,8 +137,7 @@ const getConfigFromEnv = () => {
       oauthDomain: process.env.COMPANION_OAUTH_DOMAIN,
       validHosts,
     },
-    // todo next major make this default false
-    enableUrlEndpoint: process.env.COMPANION_ENABLE_URL_ENDPOINT == null || process.env.COMPANION_ENABLE_URL_ENDPOINT === 'true',
+    enableUrlEndpoint: process.env.COMPANION_ENABLE_URL_ENDPOINT === 'true',
     periodicPingUrls: process.env.COMPANION_PERIODIC_PING_URLS ? process.env.COMPANION_PERIODIC_PING_URLS.split(',') : [],
     periodicPingInterval: process.env.COMPANION_PERIODIC_PING_INTERVAL
       ? parseInt(process.env.COMPANION_PERIODIC_PING_INTERVAL, 10) : undefined,

packages/@uppy/companion/test/__tests__/providers.js

@@ -377,7 +377,7 @@ describe('connect to provider', () => {
 
     if (authProvider.authProvider == null) return
 
-    request(authServer)
+    await request(authServer)
       .get(`/${providerName}/connect?foo=bar`)
       .set('uppy-auth-token', token)
       .expect(302)

packages/@uppy/companion/test/__tests__/uploader.js

@@ -227,12 +227,12 @@ describe('uploader with tus protocol', () => {
   })
 
   // https://github.com/transloadit/uppy/issues/3477
-  test('upload functions with xhr formdata and metadata', async () => {
-    nock('http://localhost').post('/', /^--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="key1"\r\n\r\nnull\r\n--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="key2"\r\n\r\ntrue\r\n--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="key3"\r\n\r\n\d+\r\n--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="key4"\r\n\r\n\[object Object\]\r\n--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="key5"\r\n\r\n\(\) => \{\}\r\n--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="key6"\r\n\r\nSymbol\(\)\r\n--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="files\[\]"; filename="uppy-file-[^"]+"\r\nContent-Type: application\/octet-stream\r\n\r\nSome file content\r\n--form-data-boundary-[a-z0-9]+--\r\n\r\n$/)
+  test('upload functions with xhr formdata and metadata without crashing the node.js process', async () => {
+    nock('http://localhost').post('/', /^--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="key1"\r\n\r\nnull\r\n--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="key2"\r\n\r\ntrue\r\n--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="key3"\r\n\r\n\d+\r\n--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="key4"\r\n\r\n\[object Object\]\r\n--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="key5"\r\n\r\n\(\) => \{\}\r\n--form-data-boundary-[a-z0-9]+\r\nContent-Disposition: form-data; name="files\[\]"; filename="uppy-file-[^"]+"\r\nContent-Type: application\/octet-stream\r\n\r\nSome file content\r\n--form-data-boundary-[a-z0-9]+--\r\n\r\n$/)
       .reply(200)
 
     const metadata = {
-      key1: null, key2: true, key3: 1234, key4: {}, key5: () => {}, key6: Symbol(''),
+      key1: null, key2: true, key3: 1234, key4: {}, key5: () => {},
     }
     const ret = await runMultipartTest({ useFormData: true, metadata })
     expect(ret).toMatchObject({ url: null, extraData: { response: expect.anything(), bytesUploaded: 17 } })

packages/@uppy/companion/test/mockoauthstate.js

@@ -9,5 +9,6 @@ module.exports = () => {
 
       return 'http://localhost:3020'
     },
+    encodeState: () => 'some-cool-nice-encrytpion',
   }
 }

packages/@uppy/companion/test/mockserver.js

@@ -40,6 +40,8 @@ const defaultEnv = {
   COMPANION_PERIODIC_PING_URLS: '',
 
   COMPANION_CLIENT_SOCKET_CONNECT_TIMEOUT: '',
+
+  COMPANION_ENABLE_URL_ENDPOINT: 'true',
 }
 
 function updateEnv (env) {