{"record":{"id":"2120e26f3df6d891","repo":"santifer/career-ops","slug":"landingjobs-url-must-use-https-url","errorCode":null,"errorMessage":"landingjobs: URL must use HTTPS: ${url}","messagePattern":"landingjobs: URL must use HTTPS: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"providers/landingjobs.mjs","lineNumber":28,"sourceCode":"// NOTE: the v1 feed carries no company-name field — the employer slug only\n// appears in the posting URL path (`https://landing.jobs/at/<slug>/<job>`), so\n// `company` is derived best-effort from that slug (humanized) and falls back to\n// the portal entry name. The whole active set is returned in one call.\n//\n// Wire in via a `job_boards:` entry with `provider: landingjobs`.\n\nconst FEED_URL = 'https://landing.jobs/api/v1/jobs';\nconst TRUSTED_HOST = 'landing.jobs';\n\n/** @param {string} url */\nfunction assertLandingUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`landingjobs: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`landingjobs: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`landingjobs: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n// NaN-safe Date.parse.\nfunction toEpochMs(value) {\n  if (typeof value !== 'string' || !value) return undefined;\n  const parsed = Date.parse(value);\n  return Number.isNaN(parsed) ? undefined : parsed;\n}\n\n/**\n * Derive a best-effort company name from a Landing.jobs posting URL.\n * Posting URLs are `https://landing.jobs/at/<slug>/<job>`; the `<slug>` is\n * humanized (hyphens/underscores → spaces, title-cased). Returns '' when the\n * URL is not the expected `/at/<slug>/…` shape. Exported for unit tests.","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/santifer/career-ops/blob/aac998c7ed7248ea853b720ceeb1fdbeb322fc5d/providers/landingjobs.mjs#L10-L46","documentation":"assertLandingUrl enforces an HTTPS-only policy: after successfully parsing the URL, it rejects any URL whose protocol is not 'https:'. This prevents credentials or job data from being sent over plaintext and blocks downgrade attacks. The thrown message includes the offending URL verbatim.","triggerScenarios":"Passing a parsed-valid URL that uses http:, ftp:, or any non-https scheme — e.g. 'http://landingjobs.co/api/jobs' — to assertLandingUrl or to the provider's fetch path.","commonSituations":"Old config entries written before HTTPS was enforced, hand-typed http:// URLs in portals.yml, or URLs sourced from external data that still point at plain HTTP.","solutions":["Change the scheme to https:// in the URL or in the portals.yml entry.","Search the config for 'http://' occurrences and replace with 'https://'.","If the target genuinely does not support HTTPS, do not bypass the check — treat the endpoint as unusable and remove or replace the entry.","Test the corrected URL with new URL(u).protocol === 'https:' before calling the provider."],"exampleFix":"// before\nassertLandingUrl('http://landingjobs.co/api/jobs');\n// after\nassertLandingUrl('https://landingjobs.co/api/jobs');","handlingStrategy":"validation","validationCode":"function isHttpsUrl(u) { try { return new URL(u).protocol === 'https:'; } catch { return false; } }\nif (!isHttpsUrl(url)) throw new Error(`refusing non-HTTPS endpoint: ${url}`);","typeGuard":"function isHttpsUrlString(v) { if (typeof v !== 'string') return false; try { return new URL(v).protocol === 'https:'; } catch { return false; } }","tryCatchPattern":"try {\n  provider.fetch(entry, ctx);\n} catch (e) {\n  if (e.message.startsWith('landingjobs: URL must use HTTPS')) {\n    console.warn(`Upgrading to https: ${e.message}`);\n    return provider.fetch({ ...entry, url: entry.url.replace(/^http:/, 'https:') }, ctx);\n  }\n  throw e;\n}","preventionTips":["Default to https:// in all config templates and docs","Run a CI check that no http:// URLs appear in portals.yml","Normalize http->https at config load time when safe","Treat plaintext endpoints as unavailable rather than downgrading security"],"tags":["url-validation","https","security"],"backgroundTag":"invalid-url","analyzedSha":"aac998c7ed7248ea853b720ceeb1fdbeb322fc5d","analyzedAt":"2026-09-16T06:35:29.214Z","contentChangedAt":"2026-09-16T06:35:29.214Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}