@uppy/companion: add oauthOrigin option

[aduh95]

No description provided.

[github-actions]

Diff output files

diff --git a/packages/@uppy/companion/lib/server/controllers/connect.js b/packages/@uppy/companion/lib/server/controllers/connect.js
index ceac203..49b0c5c 100644
--- a/packages/@uppy/companion/lib/server/controllers/connect.js
+++ b/packages/@uppy/companion/lib/server/controllers/connect.js
@@ -14,11 +14,24 @@ const queryString = (params, prefix = "?") => {
  */
 module.exports = function connect(req, res) {
   var _a;
-  const { secret } = req.companion.options;
+  const { secret, oauthOrigin } = req.companion.options;
   const stateObj = oAuthState.generateState();
-  if (req.query.state) {
+  // not sure if we need to store origin in the session state (e.g. we could've just gotten it directly inside send-token)
+  // but we're afraid to change the logic there
+  if (oauthOrigin && !Array.isArray(oauthOrigin)) {
+    // If the server only allows a single origin, we ignore the client-supplied
+    // origin from query because we don't need it.
+    stateObj.origin = oauthOrigin;
+  } else if (oauthOrigin && oauthOrigin.length < 2) {
+    // eslint-disable-next-line prefer-destructuring
+    stateObj.origin = oauthOrigin[0];
+  } else {
+    // If we have multiple allowed origins, we need to check the client-supplied origin from query.
+    // If the client provides an untrusted origin,
+    // we want to send `undefined`. `undefined` means `/`, which is the same origin when passed to `postMessage`.
+    // https://html.spec.whatwg.org/multipage/web-messaging.html#dom-window-postmessage-options-dev
     const { origin } = JSON.parse(atob(req.query.state));
-    stateObj.origin = origin;
+    stateObj.origin = oauthOrigin ? oauthOrigin.find(o => o === origin) : origin;
   }
   if (req.companion.options.server.oauthDomain) {
     stateObj.companionInstance = req.companion.buildURL("", true);
diff --git a/packages/@uppy/companion/lib/standalone/helper.js b/packages/@uppy/companion/lib/standalone/helper.js
index 6a83a86..d42c91c 100644
--- a/packages/@uppy/companion/lib/standalone/helper.js
+++ b/packages/@uppy/companion/lib/standalone/helper.js
@@ -62,6 +62,7 @@ const defaultStandaloneGetKey = (...args) => `${s3Prefix}${utils.defaultGetKey(.
  * @returns {object}
  */
 const getConfigFromEnv = () => {
+  var _a;
   const uploadUrls = process.env.COMPANION_UPLOAD_URLS;
   const domains = process.env.COMPANION_DOMAINS || process.env.COMPANION_DOMAIN || null;
   const validHosts = domains ? domains.split(",") : [];
@@ -180,6 +181,9 @@ const getConfigFromEnv = () => {
     corsOrigins: getCorsOrigins(),
     testDynamicOauthCredentials: process.env.COMPANION_TEST_DYNAMIC_OAUTH_CREDENTIALS === "true",
     testDynamicOauthCredentialsSecret: process.env.COMPANION_TEST_DYNAMIC_OAUTH_CREDENTIALS_SECRET,
+    oauthOrigin: ((_a = process.env.COMPANION_OAUTH_ORIGIN) === null || _a === void 0 ? void 0 : _a.includes(","))
+      ? process.env.COMPANION_OAUTH_ORIGIN.split(",")
+      : process.env.COMPANION_OAUTH_ORIGIN,
   };
 };
 /**