[PROD-30208] - add check on s3 url for @ after domain to prevent security risks

[CharisVrettos]

No description provided.

[klesgidis]

Clever! 💯
I think we could also simplify it by doing

Suggested change

	const { hostname, protocol, pathname} = new URL(value);
	if (!isOwnS3Path(bucket, `${protocol}//${hostname}${pathname}`)) {
	const { origin } = new URL(value);
	if (!isOwnS3Path(bucket, origin)) {

[CharisVrettos]

As talked offline we need the path name also to make the validation because s3 can have the bucket in the path after domain

[tomtoump]

@CharisVrettos Wouldn't it be better to update isOwnS3Path's definition? This would also solve the same issue for cases like this, that import the specific function.

[tomtoump]

I was trying to say that the url parsing could take place in the function's definition here, instead of inside the validate() function of the urlInOwnS3 joi extension.

[CharisVrettos]

Sure, will move the destructuring in isOwnS3Path