{"record":{"id":"de721dc69a08c9a2","repo":"santifer/career-ops","slug":"larajobs-untrusted-hostname-parsed-hostname","errorCode":null,"errorMessage":"larajobs: untrusted hostname \"${parsed.hostname}\" - must be ${TRUSTED_HOST}","messagePattern":"larajobs: untrusted hostname \"(.+?)\" - must be (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"providers/larajobs.mjs","lineNumber":29,"sourceCode":"// `<job:company>` and `<job:location>`, so company and location come straight\n// from the feed (no title-splitting heuristics needed).\n//\n// Wire in via a `job_boards:` entry with `provider: larajobs`.\n\nconst FEED_URL = 'https://larajobs.com/feed';\nconst TRUSTED_HOST = 'larajobs.com';\n\n/** @param {string} url */\nfunction assertLarajobsUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`larajobs: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`larajobs: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`larajobs: untrusted hostname \"${parsed.hostname}\" - must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n// NaN-safe Date.parse - `|| undefined` would also coerce a valid epoch 0.\nfunction toEpochMs(value) {\n  if (!value) return undefined;\n  const parsed = Date.parse(value);\n  return Number.isNaN(parsed) ? undefined : parsed;\n}\n\nfunction fallbackCompany(entry) {\n  return typeof entry?.name === 'string' && entry.name.trim() ? entry.name.trim() : 'LaraJobs';\n}\n\n/** @type {Provider} */\nexport default {\n  id: 'larajobs',","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/santifer/career-ops/blob/aac998c7ed7248ea853b720ceeb1fdbeb322fc5d/providers/larajobs.mjs#L11-L47","documentation":"assertLarajobsUrl pins the hostname to a single TRUSTED_HOST. An HTTPS URL aimed at any other hostname — including subdomain variants or mirrors — is rejected with this error listing the offending hostname and the required one.","triggerScenarios":"Passing an https URL whose parsed hostname !== TRUSTED_HOST, e.g. 'https://www.larajobs.com/...', a different TLD, or a proxy/mock host substituted for testing.","commonSituations":"Config pointing at a corporate proxy, 'www.' prefix added by hand, typo in TLD (.io vs .com), or swapping the endpoint for a staging server without realizing the allowlist.","solutions":["Set the hostname to exactly TRUSTED_HOST (check the constant in providers/larajobs.mjs).","Remove any 'www.' prefix or correct the TLD in the URL/config.","Don't bypass for tests — the pin is an SSRF guard; use a sanctioned configuration point instead.","Compare the parsed hostname printed in the error with the expected constant to identify the exact mismatch."],"exampleFix":"// before\nassertLarajobsUrl('https://www.larajobs.com/api/jobs');\n// after\nassertLarajobsUrl('https://larajobs.com/api/jobs');","handlingStrategy":"validation","validationCode":"const TRUSTED_HOST = 'larajobs.com';\nfunction isTrustedHost(u) { try { return new URL(u).hostname === TRUSTED_HOST; } catch { return false; } }\nif (!isTrustedHost(url)) throw new Error(`larajobs host not allowed: ${url}`);","typeGuard":"function isTrustedUrl(v) { if (typeof v !== 'string') return false; try { return new URL(v).hostname === TRUSTED_HOST && new URL(v).protocol === 'https:'; } catch { return false; } }","tryCatchPattern":"try {\n  provider.fetch(entry, ctx);\n} catch (e) {\n  if (e.message.includes('untrusted hostname')) {\n    console.error(`larajobs entry points at wrong host: ${e.message}`);\n    return null;\n  }\n  throw e;\n}","preventionTips":["Pin endpoint URLs from provider source, not from memory","Watch for 'www.' prefixes and wrong TLDs when hand-editing config","Review config diffs for host changes","Keep the SSRF pin; test against mocks via injected fetch, not altered hostnames"],"tags":["url-validation","ssrf","allowlist","security"],"backgroundTag":"invalid-url","analyzedSha":"aac998c7ed7248ea853b720ceeb1fdbeb322fc5d","analyzedAt":"2026-09-16T06:35:29.214Z","contentChangedAt":"2026-09-16T06:35:29.214Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}