{"record":{"id":"408da98668fd297a","repo":"santifer/career-ops","slug":"echojobs-invalid-url-url","errorCode":null,"errorMessage":"echojobs: invalid URL: ${url}","messagePattern":"echojobs: invalid URL: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"providers/echojobs.mjs","lineNumber":28,"sourceCode":"// Each row's `url` is the ORIGINAL ATS posting (e.g. jobs.ashbyhq.com/…), so —\n// unlike the feed host — job URLs are not pinned to echojobs.io; only the feed\n// fetch is host-locked. The url is display-only and never server-fetched here.\n//\n// Wire in via a `job_boards:` entry with `provider: echojobs`.\n\nconst FEED_BASE = 'https://echojobs.io/api/jobs';\nconst TRUSTED_HOST = 'echojobs.io';\nconst PER_PAGE = 100;\nconst DEFAULT_MAX_PAGES = 3;\nconst MAX_PAGES_CAP = 50;\n\n/** @param {string} url */\nfunction assertEchojobsUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`echojobs: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`echojobs: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`echojobs: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */\nfunction resolveMaxPages(entry) {\n  const v = entry?.max_pages;\n  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);\n  return DEFAULT_MAX_PAGES;\n}\n\n// Guards against a doubled marker when the board already spells the work model\n// into the location itself (\"Berlin (Hybrid)\", \"Hybrid - London\").\nconst HYBRID_MARKER = /\\bhybrid\\b/i;","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/santifer/career-ops/blob/9b17a8ac97b398a496b38e423ae24e433b43254f/providers/echojobs.mjs#L10-L46","documentation":"Thrown by echojobs' assertEchojobsUrl when new URL() cannot parse the value. It is defense-in-depth: in the shipped fetch() the URL is always built from the FEED_BASE constant ('https://echojobs.io/api/jobs') plus a query string, so it is always well-formed and this branch is unreachable through normal use. Reachable only via a direct assertEchojobsUrl call (e.g. a unit test or custom integration).","triggerScenarios":"assertEchojobsUrl is called directly with a non-URL value. fetch() constructs the URL internally from a constant, so no entry config can produce this.","commonSituations":"A unit test asserting the guard on malformed input; a fork or custom integration that sources the URL from elsewhere. Production scans do not reach this branch.","solutions":["For direct callers, validate the value parses as a URL before invoking assertEchojobsUrl.","For normal fetch() use, no action is needed — the constant-derived URL is always valid.","Treat a production hit as a signal that the URL is no longer constant-derived (a refactor)."],"exampleFix":"// before — direct call on raw input\nassertEchojobsUrl(maybeUrl);\n\n// after — validate first\ntry { new URL(maybeUrl); } catch { /* not a URL, skip */ }","handlingStrategy":"validation","validationCode":"// Through fetch() this is unreachable (URL built from FEED_BASE). For a direct assertEchojobsUrl call:\nfunction isParseableUrl(u) { try { new URL(u); return true; } catch { return false; } }","typeGuard":"function isParseableUrl(u) {\n  if (typeof u !== 'string' || !u) return false;\n  try { new URL(u); return true; } catch { return false; }\n}","tryCatchPattern":"// Only relevant for direct assertEchojobsUrl callers.\ntry { assertEchojobsUrl(url); }\ncatch (e) {\n  if (/^echojobs: invalid URL/.test(e.message)) { /* input wasn't a URL — skip */ }\n  else throw e;\n}","preventionTips":["No action needed for normal scans — fetch() builds the URL from a constant.","For direct calls, pre-parse with new URL().","Treat a production hit as a refactor signal (URL no longer constant-derived)."],"tags":["url-validation","echojobs","ssrf","defense-in-depth"],"backgroundTag":null,"analyzedSha":"9b17a8ac97b398a496b38e423ae24e433b43254f","analyzedAt":"2026-08-13T00:48:39.135Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}