{"record":{"id":"640c2df6fb58eabf","repo":"santifer/career-ops","slug":"themuse-url-must-use-https-url","errorCode":null,"errorMessage":"themuse: URL must use HTTPS: ${url}","messagePattern":"themuse: URL must use HTTPS: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"providers/themuse.mjs","lineNumber":22,"sourceCode":"// The Muse provider — public, zero-auth JSON jobs feed.\n// Endpoint: https://www.themuse.com/api/public/jobs?page={n}\n// Response shape: { results: [...], page: n, page_count: N }\n// All pages are fetched sequentially and aggregated before normalizing.\n//\n// Wire in via a `job_boards:` entry with `provider: themuse`.\n\nconst FEED_BASE = 'https://www.themuse.com/api/public/jobs';\nconst TRUSTED_HOST = 'www.themuse.com';\n\n/** @param {string} url */\nfunction assertMuseUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`themuse: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`themuse: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`themuse: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n/**\n * Normalize a single result from the Muse API response. Exported for unit tests.\n *\n * Field mapping:\n *   name              → title\n *   refs.landing_page → url\n *   company.name      → company\n *   locations[0].name → location\n *\n * Returns null when required fields (title or url) are missing or invalid.\n *\n * @param {any} j","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/santifer/career-ops/blob/9b17a8ac97b398a496b38e423ae24e433b43254f/providers/themuse.mjs#L4-L40","documentation":"assertMuseUrl's second check rejects any protocol other than 'https:'. As with the other themuse guards, it validates the hardcoded FEED_BASE, so it fires only if FEED_BASE was changed to an http:// (or other-scheme) value. The provider is HTTPS-only by policy.","triggerScenarios":"FEED_BASE was edited to an http:// URL, or assertMuseUrl is called from a fork/test with a non-https URL.","commonSituations":"Fork retargeting the feed to a non-https mirror; a test exercising the guard with http input.","solutions":["Restore FEED_BASE to its https://www.themuse.com/... default","Ensure any retargeted feed host is served over https"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"try { if (new URL(FEED_BASE).protocol !== 'https:') throw 0; } catch { throw new Error('themuse: FEED_BASE must be an https URL'); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep FEED_BASE on https://.","Validate the constant in a startup self-check."],"tags":["ssrf-guard","url-validation","https","themuse","unreachable-defensive"],"backgroundTag":null,"analyzedSha":"9b17a8ac97b398a496b38e423ae24e433b43254f","analyzedAt":"2026-08-13T00:48:39.135Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}