{"record":{"id":"cb66b454c6c1cb4d","repo":"santifer/career-ops","slug":"echojobs-url-must-use-https-url","errorCode":null,"errorMessage":"echojobs: URL must use HTTPS: ${url}","messagePattern":"echojobs: URL must use HTTPS: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"providers/echojobs.mjs","lineNumber":30,"sourceCode":"// fetch is host-locked. The url is display-only and never server-fetched here.\n//\n// Wire in via a `job_boards:` entry with `provider: echojobs`.\n\nconst FEED_BASE = 'https://echojobs.io/api/jobs';\nconst TRUSTED_HOST = 'echojobs.io';\nconst PER_PAGE = 100;\nconst DEFAULT_MAX_PAGES = 3;\nconst MAX_PAGES_CAP = 50;\n\n/** @param {string} url */\nfunction assertEchojobsUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`echojobs: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`echojobs: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`echojobs: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */\nfunction resolveMaxPages(entry) {\n  const v = entry?.max_pages;\n  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);\n  return DEFAULT_MAX_PAGES;\n}\n\n// Guards against a doubled marker when the board already spells the work model\n// into the location itself (\"Berlin (Hybrid)\", \"Hybrid - London\").\nconst HYBRID_MARKER = /\\bhybrid\\b/i;\n\n/**","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/santifer/career-ops/blob/9b17a8ac97b398a496b38e423ae24e433b43254f/providers/echojobs.mjs#L12-L48","documentation":"Thrown by echojobs' assertEchojobsUrl when the URL parses but its protocol is not https. Defense-in-depth: fetch() builds the URL from FEED_BASE ('https://...'), so the protocol is always https and this branch is unreachable through normal use. Reachable only via a direct assertEchojobsUrl call on an http URL.","triggerScenarios":"assertEchojobsUrl is called directly with a well-formed http:// URL. No entry config or fetch() path produces this, since FEED_BASE is an https constant.","commonSituations":"A direct integration or test passing an http URL to the guard. Production scans cannot reach this branch.","solutions":["For direct callers, pass only https URLs.","For normal fetch() use, no action — the constant is https.","Investigate if seen in production: FEED_BASE was changed or the URL is no longer constant-derived."],"exampleFix":"// before\nassertEchojobsUrl('http://echojobs.io/api/jobs?page=1');\n\n// after\nassertEchojobsUrl('https://echojobs.io/api/jobs?page=1');","handlingStrategy":"validation","validationCode":"function isHttpsUrl(u) { try { return new URL(u).protocol === 'https:'; } catch { return false; } }","typeGuard":"function isHttpsUrl(u) {\n  if (typeof u !== 'string' || !u) return false;\n  try { return new URL(u).protocol === 'https:'; } catch { return false; }\n}","tryCatchPattern":"try { assertEchojobsUrl(url); }\ncatch (e) {\n  if (/^echojobs: URL must use HTTPS/.test(e.message)) { /* upgrade to https or skip */ }\n  else throw e;\n}","preventionTips":["No action for normal scans — FEED_BASE is https.","For direct calls, normalise to https first.","Reject http at config time."],"tags":["url-validation","echojobs","ssrf","tls","defense-in-depth"],"backgroundTag":null,"analyzedSha":"9b17a8ac97b398a496b38e423ae24e433b43254f","analyzedAt":"2026-08-13T00:48:39.135Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}