{"record":{"id":"a9cb2ce6401ae6de","repo":"santifer/career-ops","slug":"getonbrd-untrusted-hostname-parsed-hostname","errorCode":null,"errorMessage":"getonbrd: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}","messagePattern":"getonbrd: untrusted hostname \"(.+?)\" — must be (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"providers/getonbrd.mjs","lineNumber":85,"sourceCode":"  if (out.length > MAX_CATEGORIES) {\n    throw new Error(\n      `getonbrd: ${out.length} categories configured — cap is ${MAX_CATEGORIES} (each one costs up to max_pages requests)`,\n    );\n  }\n  return out;\n}\n\n/** @param {string} url */\nfunction assertGetonbrdUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`getonbrd: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`getonbrd: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`getonbrd: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */\nfunction resolveMaxPages(entry) {\n  const v = entry?.max_pages;\n  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);\n  return DEFAULT_MAX_PAGES;\n}\n\n/**\n * Normalize a single Get on Board job (JSON:API resource). Exported for tests.\n *\n * Field mapping → the normalized Job shape:\n *   - title:    `attributes.title`, trimmed (items without one are dropped).\n *   - url:      `links.public_url` — an absolute `https:` posting URL host-locked\n *               to www.getonbrd.com (off-host or non-https drops the item). It is","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/santifer/career-ops/blob/aac998c7ed7248ea853b720ceeb1fdbeb322fc5d/providers/getonbrd.mjs#L67-L103","documentation":"assertGetonbrdUrl restricts URLs to a single trusted host, TRUSTED_HOST = 'www.getonbrd.com'. If the parsed URL is valid HTTPS but points at any other hostname (apex domain getonbrd.com without www, a mirror, or an unrelated host), the function throws this error naming the offending hostname. This is an SSRF/spoofing guard: category slugs and entry URLs are config-derived, so the host allowlist prevents a bad config from pointing the fetcher anywhere else.","triggerScenarios":"A portals.yml entry uses https://getonbrd.com/... (missing the www. prefix), a typo'd or lookalike domain (getonbrd.co, getonboard.com), or any third-party URL fed to the getonbrd provider.","commonSituations":"Omitting 'www.' by hand; assuming the apex domain is equivalent to the canonical host; trying to point the provider at a staging or proxy host; paste errors from a search result.","solutions":["Use exactly https://www.getonbrd.com (with the www prefix) as the host in the entry","Check for typos or lookalike domains in the configured URL","If you need a different host, the provider does not support it — the allowlist is a hard security boundary, so remove the custom URL and rely on the default feed host"],"exampleFix":"// before\ncareers_url: https://getonbrd.com/api/v0/categories/programming/jobs\n// after\ncareers_url: https://www.getonbrd.com/api/v0/categories/programming/jobs","handlingStrategy":"validation","validationCode":"const TRUSTED = 'www.getonbrd.com';\nconst u = new URL(entry.careers_url);\nif (u.protocol !== 'https:' || u.hostname !== TRUSTED) throw new Error(`getonbrd entry ${entry.name}: URL must be https://${TRUSTED}/...`);","typeGuard":"function isTrustedGetonbrdUrl(v) { try { const u = new URL(v); return u.protocol === 'https:' && u.hostname === 'www.getonbrd.com'; } catch { return false; } }","tryCatchPattern":"try {\n  assertGetonbrdUrl(url);\n} catch (e) {\n  if (String(e.message).includes('untrusted hostname')) {\n    console.error(`Point getonbrd entries at https://www.getonbrd.com only; got: ${url}`);\n  }\n  throw e;\n}","preventionTips":["Copy the canonical host www.getonbrd.com verbatim — the apex getonbrd.com is NOT accepted","Do not point job-board providers at proxies, mirrors, or staging hosts; the allowlist is a security boundary","When adding provider entries, reuse values from existing working entries"],"tags":["ssrf","allowlist","hostname","security","getonbrd"],"backgroundTag":"invalid-url","analyzedSha":"aac998c7ed7248ea853b720ceeb1fdbeb322fc5d","analyzedAt":"2026-09-16T06:35:29.214Z","contentChangedAt":"2026-09-16T06:35:29.214Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}