{"record":{"id":"f969d9577e91b261","repo":"santifer/career-ops","slug":"itviec-untrusted-hostname-parsed-hostname","errorCode":null,"errorMessage":"itviec: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}","messagePattern":"itviec: untrusted hostname \"(.+?)\" — must be (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"providers/itviec.mjs","lineNumber":86,"sourceCode":"  /(?:Posted|Đăng)\\s*:?\\s*(?:<\\/\\w+>\\s*)?([^.<]{0,40}?(?:ago|trước)|today|hôm nay)/i;\n\n/** @param {any} ctx @param {number} ms */\nfunction sleep(ctx, ms) {\n  if (typeof ctx?.sleep === 'function') return ctx.sleep(ms);\n  return new Promise((r) => setTimeout(r, ms));\n}\n\n/** @param {string} url */\nfunction assertItviecUrl(url) {\n  let parsed;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`itviec: invalid URL: ${url}`);\n  }\n  if (parsed.protocol !== 'https:') throw new Error(`itviec: URL must use HTTPS: ${url}`);\n  if (parsed.hostname !== TRUSTED_HOST) {\n    throw new Error(`itviec: untrusted hostname \"${parsed.hostname}\" — must be ${TRUSTED_HOST}`);\n  }\n  return url;\n}\n\n/**\n * Collapse a markup fragment to its visible text.\n * @param {string} fragment\n * @returns {string}\n */\nexport function visibleText(fragment) {\n  return decodeEntities(\n    String(fragment ?? '')\n      .replace(/<!--[\\s\\S]*?-->/g, ' ')\n      .replace(/<[^>]+>/g, ' '),\n  )\n    .replace(/\\s+/g, ' ')\n    .trim();\n}","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/santifer/career-ops/blob/aac998c7ed7248ea853b720ceeb1fdbeb322fc5d/providers/itviec.mjs#L68-L104","documentation":"Like the himalayas provider, assertItviecUrl allowlists a single trusted hostname (TRUSTED_HOST, itviec.com / www.itviec.com). If the URL parses and is https but its hostname does not exactly equal TRUSTED_HOST, this error is thrown — an SSRF guard pinning all requests to itviec.","triggerScenarios":"The hostname after parsing differs from TRUSTED_HOST: subdomains not on the allowlist (m.itviec.com), lookalike domains (itviec.com.evil.io), or a mock host (localhost) in tests.","commonSituations":"Portals.yml entry points to a mirror or aggregator domain instead of itviec itself; test harness injects a local server URL without stubbing TRUSTED_HOST; a typo like itviiec.com.","solutions":["Use the exact TRUSTED_HOST hostname in the URL (https://www.itviec.com/...)","For tests, stub/override TRUSTED_HOST rather than passing localhost URLs through the validator","Fix typos or remove misconfigured portals.yml entries pointing at non-itviec hosts"],"exampleFix":"// before\nassertItviecUrl('https://jobs.itviec.example.com/it-jobs');\n// after\nassertItviecUrl('https://www.itviec.com/it-jobs');","handlingStrategy":"validation","validationCode":"function isTrustedItviecUrl(url, trusted = TRUSTED_HOST) {\n  try {\n    const u = new URL(url);\n    return u.protocol === 'https:' && u.hostname === trusted;\n  } catch { return false; }\n}\n// pre-check: if (!isTrustedItviecUrl(entry.careers_url)) skip entry;","typeGuard":"const hasTrustedHost = (u, host) => { try { return new URL(u).hostname === host; } catch { return false; } };","tryCatchPattern":"try {\n  assertItviecUrl(url);\n} catch (err) {\n  if (/untrusted hostname/.test(err.message)) {\n    console.warn(`non-itviec host rejected (SSRF guard): ${err.message}`);\n    return null;\n  }\n  throw err;\n}","preventionTips":["Only configure URLs on the official itviec domain","In tests, override TRUSTED_HOST for local mock servers","Beware lookalike/typo domains when hand-editing config","Run a config lint that compares hostnames against each provider's allowlist"],"tags":["ssrf-protection","url-validation","security","config"],"backgroundTag":"invalid-url","analyzedSha":"aac998c7ed7248ea853b720ceeb1fdbeb322fc5d","analyzedAt":"2026-09-16T06:35:29.214Z","contentChangedAt":"2026-09-16T06:35:29.214Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}