{"record":{"id":"3a8397537089cf30","repo":"santifer/career-ops","slug":"solidjobs-url-must-use-https-url","errorCode":null,"errorMessage":"solidjobs: URL must use HTTPS: ${url}","messagePattern":"solidjobs: URL must use HTTPS: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"providers/solidjobs.mjs","lineNumber":27,"sourceCode":"\nconst ALLOWED_HOSTS = new Set(['solid.jobs']);\n\n/**\n * Validates that the provided URL is a trusted SolidJobs API endpoint.\n * Enforces HTTPS protocol, strict hostname matching, and required path prefix.\n * \n * @param {string} url - The URL string to validate.\n * @returns {string} The validated URL string.\n * @throws {Error} If the URL is malformed, uses non-HTTPS, has an untrusted host, or wrong path.\n */\nfunction assertUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`solidjobs: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`solidjobs: URL must use HTTPS: ${url}`);\n  if (!ALLOWED_HOSTS.has(parsed.hostname))\n    throw new Error(`solidjobs: untrusted hostname \"${parsed.hostname}\" — must be solid.jobs`);\n  if (!parsed.pathname.startsWith('/public-api/offers/'))\n    throw new Error(`solidjobs: URL path must start with /public-api/offers/: ${url}`);\n  return url;\n}\n\n/** @type {Provider} */\nexport default {\n  id: 'solidjobs',\n\n  /**\n   * Attempts to detect if the provider can handle the given entry by checking the careers_url.\n   * * @param {{ careers_url?: string, name?: string }} entry - The configuration entry.\n   * @returns {{url: string} | null} An object with the matched URL, or null if not matched.\n   */\n  detect(entry) {\n    const url = entry.careers_url || '';","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/santifer/career-ops/blob/9b17a8ac97b398a496b38e423ae24e433b43254f/providers/solidjobs.mjs#L9-L45","documentation":"assertUrl's second check rejects any URL whose protocol is not exactly 'https:'. It fires after a successful parse but before the host/path checks, so the URL is well-formed but insecure.","triggerScenarios":"entry.careers_url is a valid http:// URL pointing at solid.jobs (e.g. http://solid.jobs/public-api/offers/it). The provider is HTTPS-only by policy.","commonSituations":"A careers_url copied from a non-secure source, an old bookmark, or a tenant that still serves http. The fix is mechanical: upgrade the scheme.","solutions":["Change the scheme from http:// to https://","Confirm solid.jobs serves the API over https (it does)","Re-run the scan to confirm the entry now resolves"],"exampleFix":"# before\ncareers_url: http://solid.jobs/public-api/offers/it\n# after\ncareers_url: https://solid.jobs/public-api/offers/it","handlingStrategy":"validation","validationCode":"// Enforce https before the provider's own check fires.\nfunction isHttps(v) {\n  try { return new URL(v).protocol === 'https:'; } catch { return false; }\n}\nif (!isHttps(entry.careers_url)) {\n  console.warn(`${entry.name}: careers_url must use https://`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize every careers_url on https:// in portals.yml.","Add a lint rule rejecting http:// careers URLs."],"tags":["url-validation","https","config","solidjobs","portals-yml"],"backgroundTag":null,"analyzedSha":"9b17a8ac97b398a496b38e423ae24e433b43254f","analyzedAt":"2026-08-13T00:48:39.135Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}