santifer/career-ops · error · Error

agentic-jobs: untrusted hostname "${parsed.hostname}" — must

Error message

agentic-jobs: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}

What it means

The final agentic-jobs URL guard pins the hostname to TRUSTED_HOST ('agentic-engineering-jobs.com'). Any other hostname is rejected as an SSRF allowlist violation — the provider only ever fetches from its one known API host. Combined with redirect:'error' on the fetch, this closes both the redirect and direct-misconfiguration SSRF vectors.

Source

Thrown at providers/agentic-jobs.mjs:49

const SITE_ORIGIN = 'https://agentic-engineering-jobs.com';
const API_BASE = `${SITE_ORIGIN}/api/v1`;
const TRUSTED_HOST = 'agentic-engineering-jobs.com';
const PAGE_SIZE = 50; // fixed by the API (meta.per_page)
const MAX_PAGES = 40; // safety cap on request count (40*50 = 2000 postings)
const MAX_JOBS = 2000;
const PAGE_DELAY_MS = 2100; // stays under the documented 30 req/60s limit

/** @param {string} url */
function assertAgenticUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`agentic-jobs: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`agentic-jobs: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`agentic-jobs: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

const regionNames = new Intl.DisplayNames(['en'], { type: 'region' });

/**
 * Resolve a two-letter ISO country code to an English name. Returns '' for
 * anything that isn't a resolvable two-letter code. Exported for tests.
 * @param {unknown} code
 */
export function countryName(code) {
  if (typeof code !== 'string' || !/^[A-Za-z]{2}$/.test(code)) return '';
  try {
    const name = regionNames.of(code.toUpperCase());
    return name && name !== code.toUpperCase() ? name : '';
  } catch {
    return '';

View on GitHub (pinned to 9b17a8ac97)

Solutions

Confirm TRUSTED_HOST at the top of providers/agentic-jobs.mjs is the real API host and API_BASE uses that exact host.
Avoid subdomain variants unless TRUSTED_HOST is updated to allow them (kept tight by design).

Example fix

// before
const TRUSTED_HOST = 'www.agentic-engineering-jobs.com'; // wrong subdomain
const API_BASE = `https://${TRUSTED_HOST}/api`;

// after
const TRUSTED_HOST = 'agentic-engineering-jobs.com';
const API_BASE = `https://${TRUSTED_HOST}/api`;

Defensive patterns

Strategy: validation

Validate before calling

const TRUSTED_HOST = 'agentic-engineering-jobs.com';
function isTrustedApiUrl(u) {
  try {
    const p = new URL(u);
    return p.protocol === 'https:' && p.hostname === TRUSTED_HOST;
  } catch { return false; }
}
if (!isTrustedApiUrl(API_BASE)) throw new Error('agentic-jobs API host not trusted');

Type guard

/** @param {unknown} u @param {string} host @returns {u is string} */
function isTrustedHostUrl(u, host) {
  if (typeof u !== 'string') return false;
  try { return new URL(u).hostname === host; } catch { return false; }
}

Try / catch

try { assertAgenticUrl(url); } catch (err) {
  if (/untrusted hostname/.test(err.message)) console.error('agentic-jobs API host must be', TRUSTED_HOST);
  throw err;
}

Prevention

Keep TRUSTED_HOST tight; pair with redirect:'error' (this provider does) to close redirect-SSRF.
Lint against widening the allowlist without an explicit code review.

When it happens

Trigger: The parsed URL hostname differs from TRUSTED_HOST: a wrong subdomain, a different domain, or an internal host/IP. Server-side redirects are already blocked by redirect:'error', so this catches a directly-misconfigured API_BASE.

Common situations: API_BASE edited to a wrong host (e.g. a mirror or the marketing site); TRUSTED_HOST not updated after upstream renamed; 'www.' subdomain prefix mismatch.

Related errors

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/501a10bd3be7336a. Report an issue: GitHub.