{"record":{"id":"69aedb9b0ea042a9","repo":"santifer/career-ops","slug":"comeet-url-must-use-https-redacttoken-url","errorCode":null,"errorMessage":"comeet: URL must use HTTPS: ${redactToken(url)}","messagePattern":"comeet: URL must use HTTPS: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"providers/comeet.mjs","lineNumber":36,"sourceCode":"  if (typeof raw !== 'string' || !raw) return false;\n  let parsed;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    return false;\n  }\n  return parsed.protocol === 'https:' && parsed.hostname === COMEET_API_HOST && parsed.pathname.startsWith('/careers-api/');\n}\n\n/** @param {string} url */\nfunction assertComeetUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`comeet: invalid URL: ${redactToken(url)}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`comeet: URL must use HTTPS: ${redactToken(url)}`);\n  if (parsed.hostname !== COMEET_API_HOST)\n    throw new Error(`comeet: untrusted hostname \"${parsed.hostname}\" — must be ${COMEET_API_HOST}`);\n  if (!parsed.pathname.startsWith('/careers-api/'))\n    throw new Error(`comeet: URL path must be the careers-api endpoint: ${redactToken(url)}`);\n  return url;\n}\n\n// Redact the per-tenant ?token= so neither the (informational, possibly-logged)\n// DetectHit url nor a thrown validation error carries the secret. Best-effort:\n// falls back to a regex strip when the value can't be parsed as a URL.\nfunction redactToken(url) {\n  try {\n    const parsed = new URL(url);\n    if (parsed.searchParams.has('token')) parsed.searchParams.set('token', 'REDACTED');\n    return parsed.href;\n  } catch {\n    return typeof url === 'string' ? url.replace(/([?&]token=)[^&#]*/gi, '$1REDACTED') : url;\n  }","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/santifer/career-ops/blob/9b17a8ac97b398a496b38e423ae24e433b43254f/providers/comeet.mjs#L18-L54","documentation":"Thrown by comeet's assertComeetUrl when the URL parses but its protocol is not https. Like the other assertComeetUrl branches it is defense-in-depth: resolveApiUrl's isComeetApiUrl already enforces protocol === 'https:' and returns null (→ error 165) for any non-https input, so the normal fetch() path pre-empts this with error 165 instead. Reachable when assertComeetUrl is invoked directly on an http URL.","triggerScenarios":"assertComeetUrl is called (directly, outside fetch()) with a well-formed http:// URL. Through fetch(), an http entry.api/entry.careers_url fails isComeetApiUrl first and surfaces as error 165.","commonSituations":"A test or custom integration passing an http careers-api URL; an entry whose URL was upgraded to https on the Comeet side but the config still holds the old http form (which fetch() reports as 165, not here).","solutions":["For direct assertComeetUrl calls, ensure the value is an https URL before passing it.","For fetch() use, change the entry URL to https://www.comeet.co/careers-api/... (this surfaces as error 165, not 162, but the fix is the same).","Treat 162 in production logs as a signal that resolveApiUrl and assertComeetUrl have diverged."],"exampleFix":"// before\nassertComeetUrl('http://www.comeet.co/careers-api/2.0/company/abc/positions?token=x');\n\n// after\nassertComeetUrl('https://www.comeet.co/careers-api/2.0/company/abc/positions?token=x');","handlingStrategy":"validation","validationCode":"function isHttpsUrl(u) {\n  try { return new URL(u).protocol === 'https:'; } catch { return false; }\n}\nif (!isHttpsUrl(maybeUrl)) { /* skip or upgrade to https before calling assertComeetUrl */ }","typeGuard":"function isHttpsComeetCandidate(u) {\n  if (typeof u !== 'string' || !u) return false;\n  try { return new URL(u).protocol === 'https:'; } catch { return false; }\n}","tryCatchPattern":"try { assertComeetUrl(url); }\ncatch (e) {\n  if (/^comeet: URL must use HTTPS/.test(e.message)) { /* upgrade url to https and retry, or skip */ }\n  else throw e;\n}","preventionTips":["Through fetch() this is pre-empted by 165 — fix entry.api there.","For direct calls, normalise to https before asserting.","Reject http URLs at the config-validation layer."],"tags":["url-validation","comeet","ssrf","tls","defense-in-depth"],"backgroundTag":null,"analyzedSha":"9b17a8ac97b398a496b38e423ae24e433b43254f","analyzedAt":"2026-08-13T00:48:39.135Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}