{"record":{"id":"cf1cb3d2899379f1","repo":"santifer/career-ops","slug":"flowxtra-invalid-url-url","errorCode":null,"errorMessage":"flowxtra: invalid URL: ${url}","messagePattern":"flowxtra: invalid URL: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"providers/flowxtra.mjs","lineNumber":31,"sourceCode":"// arbeitnow/echojobs/thehub, not a per-company provider: scan.mjs's own\n// title/location filters narrow the result afterwards.\n//\n// Wire in via a `job_boards:` entry with `provider: flowxtra`.\n\nconst JOBS_ENDPOINT = 'https://app.flowxtra.com/api/central/jobs';\nconst TRUSTED_ENDPOINT_HOST = 'app.flowxtra.com';\nconst TRUSTED_APPLY_HOST = 'flowxtra.com';\nconst PER_PAGE = 100;\nconst DEFAULT_MAX_PAGES = 3;\nconst MAX_PAGES_CAP = 50;\n\n/** @param {string} url */\nfunction assertFlowxtraEndpointUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`flowxtra: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`flowxtra: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_ENDPOINT_HOST) {\n    throw new Error(`flowxtra: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_ENDPOINT_HOST}`);\n  }\n  return url;\n}\n\n/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */\nfunction resolveMaxPages(entry) {\n  const v = entry?.max_pages;\n  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);\n  return DEFAULT_MAX_PAGES;\n}\n\n// NaN-safe Date.parse — `|| undefined` would also coerce a valid epoch 0.\nfunction toEpochMs(value) {\n  if (!value) return undefined;","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/santifer/career-ops/blob/9b17a8ac97b398a496b38e423ae24e433b43254f/providers/flowxtra.mjs#L13-L49","documentation":"Thrown by flowxtra's assertFlowxtraEndpointUrl when new URL() cannot parse the value. Defense-in-depth: in fetch() the URL is always built from the JOBS_ENDPOINT constant ('https://app.flowxtra.com/api/central/jobs') plus a query string, so it is always well-formed and this branch is unreachable through normal use. Reachable only via a direct assertFlowxtraEndpointUrl call.","triggerScenarios":"assertFlowxtraEndpointUrl is called directly with a non-URL value. fetch() constructs the URL internally from a constant, so no entry config can produce this.","commonSituations":"A unit test or custom integration calling assertFlowxtraEndpointUrl on raw input. Production scans do not reach this branch.","solutions":["For direct callers, validate the value parses as a URL before invoking the guard.","For normal fetch() use, no action — the constant-derived URL is always valid.","Treat a production hit as a signal the URL is no longer constant-derived."],"exampleFix":"// before — direct call on raw input\nassertFlowxtraEndpointUrl(maybeUrl);\n\n// after — validate first\ntry { new URL(maybeUrl); } catch { /* not a URL, skip */ }","handlingStrategy":"validation","validationCode":"// Through fetch() unreachable (URL built from JOBS_ENDPOINT). For a direct call:\nfunction isParseableUrl(u) { try { new URL(u); return true; } catch { return false; } }","typeGuard":"function isParseableUrl(u) {\n  if (typeof u !== 'string' || !u) return false;\n  try { new URL(u); return true; } catch { return false; }\n}","tryCatchPattern":"try { assertFlowxtraEndpointUrl(url); }\ncatch (e) {\n  if (/^flowxtra: invalid URL/.test(e.message)) { /* input wasn't a URL — skip */ }\n  else throw e;\n}","preventionTips":["No action for normal scans — fetch() builds the URL from a constant.","For direct calls, pre-parse with new URL().","Treat a production hit as a refactor signal."],"tags":["url-validation","flowxtra","ssrf","defense-in-depth"],"backgroundTag":null,"analyzedSha":"9b17a8ac97b398a496b38e423ae24e433b43254f","analyzedAt":"2026-08-13T00:48:39.135Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}