santifer/career-ops · error · Error

oraclecloud: URL must use HTTPS: ${url}

Error message

oraclecloud: URL must use HTTPS: ${url}

What it means

Thrown by oraclecloud's assertOracleUrl() when the URL parses but protocol is not 'https:'. Second SSRF gate: blocks plaintext HTTP to Oracle career sites, preventing MITM and redirect-based exfiltration. Fires before each page fetch in the pagination loop.

Source

Thrown at providers/oraclecloud.mjs:68

const ORACLE_HOST_RE = /^[a-z0-9-]+\.fa\.(?:[a-z0-9-]+\.)?(?:ocs\.)?oraclecloud(?:[1-9][0-9]?)?\.com$/i;

const PAGE_SIZE = 200;
const MAX_PAGES = 25;             // safety cap (~5000 jobs); hard ceiling like workday
const RETRY_POLICY = { retries: 3 };
const INTER_PAGE_DELAY_MS = 150;  // WAF-aware spacing between same-host pages

// facetsList is a fixed constant on the finder; %3B is the encoded ';' separator.
const FACETS_LIST = 'LOCATIONS%3BWORK_LOCATIONS%3BWORKPLACE_TYPES%3BTITLES%3BCATEGORIES%3BORGANIZATIONS%3BPOSTING_DATES%3BFLEX_FIELDS';

/** @param {string} url */
function assertOracleUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`oraclecloud: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`oraclecloud: URL must use HTTPS: ${url}`);
  if (!ORACLE_HOST_RE.test(parsed.hostname)) {
    throw new Error(`oraclecloud: untrusted hostname "${parsed.hostname}" — must match *.fa[.<region>][.ocs].oraclecloud[1-99].com`);
  }
  return url;
}

// NaN-safe Date.parse — `|| undefined` would also coerce a valid epoch 0.
// (copied from greenhouse.mjs)
function toEpochMs(value) {
  if (!value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;
}

function sleep(ms, ctx) {
  if (typeof ctx?.sleep === 'function') return ctx.sleep(ms);
  return new Promise((resolve) => setTimeout(resolve, ms));
}

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Change the entry's api/careers_url to https:// in portals.yml.
2. For testing, use an HTTPS mock or a test-specific guard bypass.
3. Verify no intermediary normalizes the URL to http://.

Example fix

// before
careers_url: 'http://acme.fa.eu.oraclecloud.com/hcmUI/CandidateExperience/en/sites/CX_1'

// after
careers_url: 'https://acme.fa.eu.oraclecloud.com/hcmUI/CandidateExperience/en/sites/CX_1'

/** Normalize Oracle URL to HTTPS. */
function ensureHttps(url) {
  if (typeof url !== 'string') return null;
  return url.replace(/^http:\/\//i, 'https://');
}

entry.careers_url = ensureHttps(entry.careers_url) || entry.careers_url;

/** @param {string} url @returns {boolean} */
function isHttpsUrl(url) {
  try { return new URL(url).protocol === 'https:'; } catch { return false; }
}

try {
  await oracleProvider.fetch(entry, ctx);
} catch (err) {
  if (String(err.message).includes('must use HTTPS')) {
    entry.careers_url = (entry.careers_url || '').replace(/^http:/i, 'https:');
    await oracleProvider.fetch(entry, ctx);
  } else throw err;
}

When it happens

Trigger: A valid URL with http: scheme passed to assertOracleUrl. Sources: entry.api or entry.careers_url in portals.yml prefixed http://, or a test fixture using http://localhost. Since buildApiUrl constructs URLs from entry data, an http:// entry propagates through resolveSite → buildApiUrl → assertOracleUrl.

Common situations: YAML config authored with http://. A config tool that strips SSL. Local development against a non-TLS mock. Oracle tenant URLs copied before SSL enforcement.

Related errors

• nodesk: URL must use HTTPS: ${url}
• nofluffjobs: URL must use HTTPS: ${url}
• oraclecloud: invalid URL: ${url}
• personio: URL must use HTTPS: ${url}
• pinpoint: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/cec5174de6ec26ae. Report an issue: GitHub.