{"record":{"id":"12d6ac28a7e6cfbe","repo":"santifer/career-ops","slug":"landingjobs-untrusted-hostname-parsed-hostname","errorCode":null,"errorMessage":"landingjobs: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}","messagePattern":"landingjobs: untrusted hostname \"(.+?)\" — must be (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"providers/landingjobs.mjs","lineNumber":30,"sourceCode":"// `company` is derived best-effort from that slug (humanized) and falls back to\n// the portal entry name. The whole active set is returned in one call.\n//\n// Wire in via a `job_boards:` entry with `provider: landingjobs`.\n\nconst FEED_URL = 'https://landing.jobs/api/v1/jobs';\nconst TRUSTED_HOST = 'landing.jobs';\n\n/** @param {string} url */\nfunction assertLandingUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`landingjobs: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`landingjobs: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`landingjobs: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n// NaN-safe Date.parse.\nfunction toEpochMs(value) {\n  if (typeof value !== 'string' || !value) return undefined;\n  const parsed = Date.parse(value);\n  return Number.isNaN(parsed) ? undefined : parsed;\n}\n\n/**\n * Derive a best-effort company name from a Landing.jobs posting URL.\n * Posting URLs are `https://landing.jobs/at/<slug>/<job>`; the `<slug>` is\n * humanized (hyphens/underscores → spaces, title-cased). Returns '' when the\n * URL is not the expected `/at/<slug>/…` shape. Exported for unit tests.\n * @param {string} url\n */","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/santifer/career-ops/blob/aac998c7ed7248ea853b720ceeb1fdbeb322fc5d/providers/landingjobs.mjs#L12-L48","documentation":"assertLandingUrl enforces a host allowlist of exactly one trusted host (TRUSTED_HOST). A syntactically valid HTTPS URL pointing at any other hostname is rejected. This is an SSRF/pin hardening measure: even a correct-looking URL must land on the expected API host.","triggerScenarios":"Passing an HTTPS URL whose parsed hostname differs from TRUSTED_HOST — e.g. a mirror domain, 'www.'-prefixed variant, or an attacker-controlled lookalike host — to assertLandingUrl or the provider fetch path.","commonSituations":"Config entry pointing at a custom proxy or alternate domain, a typo like 'landingjobs.com' vs the real TLD, or intentionally swapping in a mock/test server URL.","solutions":["Correct the hostname in the URL/config so it exactly matches TRUSTED_HOST (check for 'www.', wrong TLD, or a proxy domain).","Inspect the TRUSTED_HOST constant in providers/landingjobs.mjs to see the accepted value and align your URL with it.","If you need a different host for testing, raise it with the maintainers rather than bypassing the assertion.","Note the error message interpolates the actual parsed hostname — use it to spot the mismatch precisely."],"exampleFix":"// before\nassertLandingUrl('https://api.landingjobs.io/v1/jobs');\n// after\nassertLandingUrl('https://landingjobs.co/api/jobs'); // hostname must equal TRUSTED_HOST","handlingStrategy":"validation","validationCode":"const TRUSTED_HOST = 'landingjobs.co';\nfunction isTrustedHost(u) { try { return new URL(u).hostname === TRUSTED_HOST; } catch { return false; } }\nif (!isTrustedHost(url)) throw new Error(`host not allowed: ${url}`);","typeGuard":"function isTrustedUrl(v) { if (typeof v !== 'string') return false; try { return new URL(v).hostname === TRUSTED_HOST && new URL(v).protocol === 'https:'; } catch { return false; } }","tryCatchPattern":"try {\n  provider.fetch(entry, ctx);\n} catch (e) {\n  if (e.message.includes('untrusted hostname')) {\n    console.error(`Entry points at wrong host: ${e.message}; fix portals.yml`);\n    return null;\n  }\n  throw e;\n}","preventionTips":["Never point provider URLs at proxies or staging hosts in shared config","Copy endpoint URLs from the provider source rather than typing them","Review config diffs for hostname changes","Keep the allowlist pin — do not disable it for testing; use dependency-injected fetch doubles instead"],"tags":["url-validation","ssrf","allowlist","security"],"backgroundTag":"invalid-url","analyzedSha":"aac998c7ed7248ea853b720ceeb1fdbeb322fc5d","analyzedAt":"2026-09-16T06:35:29.214Z","contentChangedAt":"2026-09-16T06:35:29.214Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}