{"record":{"id":"c4e525f55b05f12c","repo":"santifer/career-ops","slug":"eightfold-untrusted-hostname-parsed-hostname","errorCode":null,"errorMessage":"eightfold: untrusted hostname \"${parsed.hostname}\" — must match *.eightfold.ai","messagePattern":"eightfold: untrusted hostname \"(.+?)\" — must match \\*\\.eightfold\\.ai","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"providers/eightfold.mjs","lineNumber":73,"sourceCode":"\nconst RETRY_POLICY = { retries: 3, baseDelayMs: 500, maxDelayMs: 8_000 };\n\n/**\n * SSRF guard — every request URL passes through here before it is fetched.\n *\n * @param {string} url\n * @returns {string} the same URL, when it is a trusted Eightfold endpoint.\n */\nfunction assertEightfoldUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`eightfold: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`eightfold: URL must use HTTPS: ${url}`);\n  if (!EIGHTFOLD_HOST_RE.test(parsed.hostname)) {\n    throw new Error(`eightfold: untrusted hostname \"${parsed.hostname}\" — must match *.eightfold.ai`);\n  }\n  return url;\n}\n\n/** @param {number} ms @param {any} ctx */\nfunction sleep(ms, ctx) {\n  if (typeof ctx?.sleep === 'function') return ctx.sleep(ms);\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/**\n * Eightfold reports timestamps as epoch SECONDS (`t_create`, `t_update`), not\n * the ISO strings every other provider gets. Converted here; anything\n * non-finite or non-positive is dropped rather than guessed at.\n *\n * @param {unknown} value\n * @returns {number|undefined} epoch ms, or undefined.\n */","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/santifer/career-ops/blob/9b17a8ac97b398a496b38e423ae24e433b43254f/providers/eightfold.mjs#L55-L91","documentation":"Thrown by eightfold's assertEightfoldUrl when the URL is valid https but its hostname does not match /^[a-z0-9-]+\\.eightfold\\.ai$/i (EIGHTFOLD_HOST_RE). Defense-in-depth: fetch() only ever passes buildApiUrl output, whose host is the resolveTenant-validated tenant.host, so the guard is unreachable through normal use. Reachable only via a direct assertEightfoldUrl call.","triggerScenarios":"assertEightfoldUrl is called directly with an https URL on a non-*.eightfold.ai host. fetch() validates the tenant host via resolveTenant (which applies EIGHTFOLD_HOST_RE) before any URL is built, so no entry config reaches this branch.","commonSituations":"A direct integration or test pointing at a branded CNAME (e.g. careers.company.com) or a mock host. Production scans fail earlier at resolveTenant (error 177), not here.","solutions":["For direct callers, pass only https://<tenant>.eightfold.ai/... URLs.","For fetch() use, point api:/careers_url at the canonical <tenant>.eightfold.ai host (a branded CNAME is deliberately rejected — see error 177).","Treat a production hit as a signal that resolveTenant and assertEightfoldUrl have diverged."],"exampleFix":"// before — branded CNAME host\nassertEightfoldUrl('https://careers.bayer.com/api/apply/v2/jobs?start=0&num=10');\n\n// after — canonical eightfold.ai tenant host\nassertEightfoldUrl('https://bayer.eightfold.ai/api/apply/v2/jobs?start=0&num=10');","handlingStrategy":"validation","validationCode":"const EIGHTFOLD_HOST_RE = /^[a-z0-9-]+\\.eightfold\\.ai$/i;\nfunction isEightfoldHost(u) { try { return EIGHTFOLD_HOST_RE.test(new URL(u).hostname); } catch { return false; } }","typeGuard":"function isEightfoldEndpoint(u) {\n  if (typeof u !== 'string' || !u) return false;\n  try {\n    const p = new URL(u);\n    return p.protocol === 'https:' && /^[a-z0-9-]+\\.eightfold\\.ai$/i.test(p.hostname);\n  } catch { return false; }\n}","tryCatchPattern":"try { assertEightfoldUrl(url); }\ncatch (e) {\n  if (/^eightfold: untrusted hostname/.test(e.message)) { /* branded CNAME or wrong host — skip */ }\n  else throw e;\n}","preventionTips":["No action for normal scans — tenant host is pre-validated by resolveTenant.","For fetch() use, point api:/careers_url at <tenant>.eightfold.ai, not a branded CNAME (see error 177).","The API is intentionally host-pinned to *.eightfold.ai."],"tags":["url-validation","eightfold","ssrf","hostname-pin","defense-in-depth"],"backgroundTag":null,"analyzedSha":"9b17a8ac97b398a496b38e423ae24e433b43254f","analyzedAt":"2026-08-13T00:48:39.135Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}