fix: validate country input to prevent SSRF vulnerability (#1302)

[saidai-bhuvanesh]

Summary

Fixed SSRF vulnerability reported in issue #1302. The country parameter was directly used in the API URL without validation.

Changes Made

1. Added ALLOWED_COUNTRIES whitelist - Set of valid country codes supported by Adzuna API: in, us, gb, au, ca, de, fr, nl, be, at, pl, es, it, ch, sg

2. Added getValidCountry() function - Validates user input against whitelist before using in API URL. Falls back to default country code if invalid input is provided.

3. Updated getJobs controller - Now uses the validation function for req.query.country parameter.

Security Fix

• Before: country parameter directly used in URL construction
• After: country validated against whitelist before use

// Whitelist of valid country codes supported by Adzuna API
const ALLOWED_COUNTRIES = new Set(["in", "us", "gb", "au", "ca", "de", "fr", "nl", "be", "at", "pl", "es", "it", "ch", "sg"]);

function getValidCountry(country) {
  if (country && ALLOWED_COUNTRIES.has(country.toLowerCase())) {
    return country.toLowerCase();
  }
  return ADZUNA_COUNTRY;
}

Closes #1302

Summary

• Added an ALLOWED_COUNTRIES whitelist for Adzuna country codes.
• Added getValidCountry() to normalize valid codes and use the default country for invalid input.
• Updated getJobs to use the validated country for API requests and caching.
• Prevented arbitrary country values from reaching the Adzuna API URL.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 973a5c3a-6b68-44c6-9a42-bb2296712be0

📥 Commits

Reviewing files that changed from the base of the PR and between 32c4e5c and 98f90a3.

📒 Files selected for processing (1)

• backend/controllers/jobController.js

---

📝 Walkthrough

Walkthrough

The job controller now validates Adzuna country codes against a whitelist, normalizes valid values to lowercase, falls back to ADZUNA_COUNTRY for invalid or missing values, and uses the validated country for job retrieval.

Changes

Adzuna country validation

Layer / File(s)	Summary
Country validation and job retrieval backend/controllers/jobController.js	The controller adds supported Adzuna country codes and a helper that normalizes valid input or uses the configured default. Job retrieval uses the validated country.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Canopus-Labs/PrepPilot#1252: Modifies the job controller to validate and normalize Adzuna country codes.
• Canopus-Labs/PrepPilot#1274: Modifies the job controller to validate and normalize Adzuna country codes.
• Canopus-Labs/PrepPilot#1302: Modifies the job controller to validate and normalize Adzuna country codes.

Suggested reviewers: gitguru-sudo, sahare77, yuviiios

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR adds validation and normalization, but it falls back to the default country instead of returning HTTP 400 for invalid input as required by issue #1302.	Return HTTP 400 for invalid country values and include the valid country codes in the error response.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the country validation fix and its SSRF security purpose.
Out of Scope Changes check	✅ Passed	The changes remain within the requested country validation and SSRF mitigation scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}