{"record":{"id":"0411ac16280702d3","repo":"santifer/career-ops","slug":"echojobs-untrusted-hostname-parsed-hostname","errorCode":null,"errorMessage":"echojobs: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}","messagePattern":"echojobs: untrusted hostname \"(.+?)\" — must be (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"providers/echojobs.mjs","lineNumber":32,"sourceCode":"// Wire in via a `job_boards:` entry with `provider: echojobs`.\n\nconst FEED_BASE = 'https://echojobs.io/api/jobs';\nconst TRUSTED_HOST = 'echojobs.io';\nconst PER_PAGE = 100;\nconst DEFAULT_MAX_PAGES = 3;\nconst MAX_PAGES_CAP = 50;\n\n/** @param {string} url */\nfunction assertEchojobsUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`echojobs: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`echojobs: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`echojobs: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */\nfunction resolveMaxPages(entry) {\n  const v = entry?.max_pages;\n  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);\n  return DEFAULT_MAX_PAGES;\n}\n\n// Guards against a doubled marker when the board already spells the work model\n// into the location itself (\"Berlin (Hybrid)\", \"Hybrid - London\").\nconst HYBRID_MARKER = /\\bhybrid\\b/i;\n\n/**\n * Normalize a single EchoJobs feed item. Exported for tests.\n *","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/santifer/career-ops/blob/9b17a8ac97b398a496b38e423ae24e433b43254f/providers/echojobs.mjs#L14-L50","documentation":"Thrown by echojobs' assertEchojobsUrl when the URL is valid https but its hostname is not exactly echojobs.io (TRUSTED_HOST). Defense-in-depth: fetch() derives the URL from FEED_BASE whose hostname is echojobs.io, so the guard is unreachable through normal use. Reachable only via a direct assertEchojobsUrl call on a different host.","triggerScenarios":"assertEchojobsUrl is called directly with an https URL on a non-echojobs.io host. fetch() always uses the constant host, so no entry config produces this.","commonSituations":"A direct integration or test pointing at a mock/proxy host. Production scans cannot reach this branch.","solutions":["For direct callers, pass only https://echojobs.io/... URLs.","For normal fetch() use, no action — the host is constant.","If seen in production, FEED_BASE was edited or the URL is being sourced from config (which would be a deliberate API change)."],"exampleFix":"// before\nassertEchojobsUrl('https://evil.example.com/api/jobs?page=1');\n\n// after\nassertEchojobsUrl('https://echojobs.io/api/jobs?page=1');","handlingStrategy":"validation","validationCode":"function isEchojobsHost(u) { try { return new URL(u).hostname === 'echojobs.io'; } catch { return false; } }","typeGuard":"function isEchojobsEndpoint(u) {\n  if (typeof u !== 'string' || !u) return false;\n  try {\n    const p = new URL(u);\n    return p.protocol === 'https:' && p.hostname === 'echojobs.io';\n  } catch { return false; }\n}","tryCatchPattern":"try { assertEchojobsUrl(url); }\ncatch (e) {\n  if (/^echojobs: untrusted hostname/.test(e.message)) { /* wrong host — skip, do not follow */ }\n  else throw e;\n}","preventionTips":["No action for normal scans — host is constant.","For direct calls, only pass https://echojobs.io/... URLs.","Never point the feed fetch at a proxy/alternate host."],"tags":["url-validation","echojobs","ssrf","hostname-pin","defense-in-depth"],"backgroundTag":null,"analyzedSha":"9b17a8ac97b398a496b38e423ae24e433b43254f","analyzedAt":"2026-08-13T00:48:39.135Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}