{"record":{"id":"a9cb2ce6401ae6de","repo":"santifer/career-ops","slug":"getonbrd-untrusted-hostname-parsed-hostname","errorCode":null,"errorMessage":"getonbrd: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}","messagePattern":"getonbrd: untrusted hostname \"(.+?)\" — must be (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"providers/getonbrd.mjs","lineNumber":31,"sourceCode":"// Wire in via a `job_boards:` entry with `provider: getonbrd`.\n\nconst FEED_BASE = 'https://www.getonbrd.com/api/v0/categories/programming/jobs';\nconst TRUSTED_HOST = 'www.getonbrd.com';\nconst PER_PAGE = 100;\nconst DEFAULT_MAX_PAGES = 3;\nconst MAX_PAGES_CAP = 50;\n\n/** @param {string} url */\nfunction assertGetonbrdUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`getonbrd: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`getonbrd: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`getonbrd: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */\nfunction resolveMaxPages(entry) {\n  const v = entry?.max_pages;\n  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);\n  return DEFAULT_MAX_PAGES;\n}\n\n/**\n * Normalize a single Get on Board job (JSON:API resource). Exported for tests.\n *\n * Field mapping → the normalized Job shape:\n *   - title:    `attributes.title`, trimmed (items without one are dropped).\n *   - url:      `links.public_url` — an absolute `https:` posting URL host-locked\n *               to www.getonbrd.com (off-host or non-https drops the item). It is","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/santifer/career-ops/blob/9b17a8ac97b398a496b38e423ae24e433b43254f/providers/getonbrd.mjs#L13-L49","documentation":"getonbrd.mjs throws this in assertGetonbrdUrl() when the URL is valid HTTPS but its hostname is not TRUSTED_HOST ('www.getonbrd.com'). It is the host-allowlist half of the SSRF guard; with redirect:'error' it pins every Get on Board request to www.getonbrd.com. A live throw means FEED_BASE's hostname drifted off the trusted host.","triggerScenarios":"FEED_BASE was pointed at a mirror/CNAME (e.g. 'https://getonbrd-mirror.example.com/...') without updating TRUSTED_HOST; a test calls assertGetonbrdUrl('https://evil.com/...'); the constant and the trusted host were edited out of sync.","commonSituations":"Contributor adds a regional mirror but edits only one symbol; a security test throws foreign hosts at the guard; an env override redirected the provider.","solutions":["Restore FEED_BASE to https://www.getonbrd.com/api/v0/categories/programming/jobs.","If a different host is genuinely required, update TRUSTED_HOST to match in the same change and record the reason.","Keep tests that hit this branch asserting the throw rather than changing the input."],"exampleFix":"// before\nconst FEED_BASE = 'https://getonbrd-cdn.example.com/api/v0/categories/programming/jobs';\nconst TRUSTED_HOST = 'www.getonbrd.com'; // mismatch\n\n// after\nconst FEED_BASE = 'https://www.getonbrd.com/api/v0/categories/programming/jobs';\nconst TRUSTED_HOST = 'www.getonbrd.com';","handlingStrategy":"validation","validationCode":"// Startup invariant: the Get on Board feed host must equal TRUSTED_HOST.\nfunction checkGetonbrdHost() {\n  const u = new URL('https://www.getonbrd.com/api/v0/categories/programming/jobs');\n  if (u.hostname !== 'www.getonbrd.com') throw new Error('getonbrd host drift');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Change FEED_BASE and TRUSTED_HOST together; never one without the other.","Add a unit test: assert(new URL(FEED_BASE).hostname === TRUSTED_HOST).","Treat an unexpected throw here as a possible constant override and audit the source."],"tags":["ssrf-guard","host-allowlist","url-validation","getonbrd","config"],"backgroundTag":null,"analyzedSha":"9b17a8ac97b398a496b38e423ae24e433b43254f","analyzedAt":"2026-08-13T00:48:39.135Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}