Repository navigation
Conversation
…nly where allowed @uppy/tus sent every meta field of a remote file to Companion, ignoring allowedMetaFields. It now sends the allowed fields plus name and type, which Companion names the upload after and which local uploads always send too. @uppy/transloadit moved remote files to the Assembly status's companion_url whenever the file's Companion looked like Transloadit's (an unanchored match), without checking the new URL. Both must now be a Transloadit Companion URL; regional hosts like api2-us-east-1 match.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🦋 Changeset detectedLatest commit: c4243ea The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
… https Sending name and type to Companion regardless of allowedMetaFields leaked a file name the app chose not to send; local tus uploads only send them when they are allowed. Remote files now send exactly the allowed fields. The Transloadit Companion check accepted http, so a status could move a remote file's requests, with their Companion credentials, to plain http. Only https Transloadit Companion URLs match now.
There was a problem hiding this comment.
🟡 Changes recommended
The URL-validation test tears down before the assembly is installed, allowing preprocessing to open an EventSource and polling timer afterward and leave background network activity running.
1 open issue
What changed in this PR
This PR aligns remote-file uploads with Uppy’s metadata restrictions and limits Transloadit Companion rerouting to trusted HTTPS URLs.
Changes:
- Apply
allowedMetaFieldsto remote tus uploads. - Validate both Companion URLs before rerouting, including support for regional Transloadit hosts.
- Add regression tests and patch-release notes.
| File | Description |
|---|---|
packages/@uppy/tus/test/index.test.ts |
Tests metadata filtering for remote uploads. |
packages/@uppy/tus/src/index.ts |
Filters metadata sent to Companion. |
packages/@uppy/transloadit/test/index.test.js |
Tests trusted and rejected Companion destinations. |
packages/@uppy/transloadit/src/index.ts |
Validates source and destination Companion URLs. |
.changeset/remote-files-meta-and-companion.md |
Documents both fixes for patch releases. |
Review effort: Balanced
| uppy.upload().catch(() => {}) | ||
| await created | ||
|
|
||
| expect(uppy.getFile(id).remote.companionUrl).toBe(expected) | ||
| uppy.cancelAll() |
Two fixes for how uploaders handle remote (Companion) files.
@uppy/tus:allowedMetaFieldswas ignored for remote files. Local tus uploads only send the allowed meta fields, but for remote files the plugin sent all offile.metato Companion. It now sends exactly the allowed fields, like local uploads. Whenname/typearen't allowed, Companion falls back to a generated upload name, just as tusd does for a local upload without them. With the defaultallowedMetaFields: truenothing changes.@uppy/transloadit: remote files could be moved to a non-Transloaditcompanion_url. When an Assembly is created, remote files hosted on Transloadit's Companion are switched to the Companion the Assembly status names. The check only looked at the file's current Companion URL, with an unanchored regex, and never at the new URL. Now both URLs must be anhttpsTransloadit Companion URL (https://api2[-<machine>].transloadit.com/companion, trailing slash allowed), so a status can't move a remote file's requests, which carry its Companion credentials, to another host or to plainhttp. Regional hosts likeapi2-us-east-1also match now; before, the hyphen kept them from matching.Tests
httpcompanion_urlleaves the file's Companion unchanged; Transloadit machine and regional hosts are still used (fails without the fix).🤖 Generated with Claude Code