{"record":{"id":"47bacb1cb779b7c5","repo":"santifer/career-ops","slug":"arbeitnow-url-must-use-https-url","errorCode":null,"errorMessage":"arbeitnow: URL must use HTTPS: ${url}","messagePattern":"arbeitnow: URL must use HTTPS: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"providers/arbeitnow.mjs","lineNumber":32,"sourceCode":"// override with `max_pages` on the portal entry).\n//\n// Wire in via a `job_boards:` entry with `provider: arbeitnow`.\n\nconst FEED_BASE = 'https://www.arbeitnow.com/api/job-board-api';\nconst TRUSTED_HOST = 'www.arbeitnow.com';\nconst PER_PAGE = 100;\nconst DEFAULT_MAX_PAGES = 3;\nconst MAX_PAGES_CAP = 50;\n\n/** @param {string} url */\nfunction assertArbeitnowUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`arbeitnow: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`arbeitnow: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`arbeitnow: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */\nfunction resolveMaxPages(entry) {\n  const v = entry?.max_pages;\n  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);\n  return DEFAULT_MAX_PAGES;\n}\n\n/**\n * Normalize a single Arbeitnow job. Exported for unit tests.\n *\n * Field mapping → the normalized Job shape:\n *   - title:    `title`, trimmed (items without one are dropped).","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/santifer/career-ops/blob/aac998c7ed7248ea853b720ceeb1fdbeb322fc5d/providers/arbeitnow.mjs#L14-L50","documentation":"After parsing, assertArbeitnowUrl requires the protocol to be exactly https:. Any http:, ftp:, or other scheme throws this error. It's part of the provider's SSRF/transport-security guard: job-board feeds must only be fetched over TLS.","triggerScenarios":"A URL with scheme other than https reaches the validator — most commonly a plain-http feed URL ('http://www.arbeitnow.com/api/job-board-api'), an env/config override switching to http for local testing, or a protocol-relative or mistyped scheme (https:/, htps://).","commonSituations":"Local dev stubs served over http; copied documentation links that use http; config migrated from another provider that allowed http; a proxy setup that terminates TLS and rewrites URLs to http://.","solutions":["Change the URL scheme to https:// — arbeitnow's API is served over TLS, so there's no reason to use http.","If a local test needs http, stub ctx.fetchJson instead of feeding an http URL through the validator.","Fix mistyped schemes (https:/, //host) — run the string through new URL() locally to confirm protocol === 'https:' before calling.","Audit config/env for HTTP_URL-style overrides that downgrade the scheme."],"exampleFix":"// before\nconst url = 'http://www.arbeitnow.com/api/job-board-api?page=1';\n// after\nconst url = 'https://www.arbeitnow.com/api/job-board-api?page=1';","handlingStrategy":"validation","validationCode":"const u = new URL(url);\nif (u.protocol !== 'https:') throw new Error(`feed URLs must be https (got ${u.protocol})`);","typeGuard":"function isHttpsUrl(s) {\n  try { return new URL(s).protocol === 'https:'; } catch { return false; }\n}","tryCatchPattern":"try {\n  await provider.fetch(entry, ctx);\n} catch (err) {\n  if (String(err.message).includes('must use HTTPS')) {\n    console.error('Config supplied a non-HTTPS feed URL — arbeitnow serves TLS; switch the scheme to https://');\n  }\n  throw err;\n}","preventionTips":["Always write https:// in portal configs; never downgrade for local testing — stub the fetch layer instead.","Copy URLs from provider constants, not from memory or docs that may show http.","Add a startup lint over portals.yml rejecting any non-https careers/feed URL."],"tags":["url","https","security","validation"],"backgroundTag":"invalid-url-format","analyzedSha":"aac998c7ed7248ea853b720ceeb1fdbeb322fc5d","analyzedAt":"2026-09-16T06:35:29.214Z","contentChangedAt":"2026-09-16T06:35:29.214Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}