santifer/career-ops · warning · Error

echojobs: untrusted hostname "${parsed.hostname}" — must be

Error message

echojobs: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}

What it means

Thrown by echojobs' assertEchojobsUrl when the URL is valid https but its hostname is not exactly echojobs.io (TRUSTED_HOST). Defense-in-depth: fetch() derives the URL from FEED_BASE whose hostname is echojobs.io, so the guard is unreachable through normal use. Reachable only via a direct assertEchojobsUrl call on a different host.

Source

Thrown at providers/echojobs.mjs:32

// Wire in via a `job_boards:` entry with `provider: echojobs`.

const FEED_BASE = 'https://echojobs.io/api/jobs';
const TRUSTED_HOST = 'echojobs.io';
const PER_PAGE = 100;
const DEFAULT_MAX_PAGES = 3;
const MAX_PAGES_CAP = 50;

/** @param {string} url */
function assertEchojobsUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`echojobs: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`echojobs: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`echojobs: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

/** Resolve the page cap: a positive integer `max_pages` on the entry, capped. */
function resolveMaxPages(entry) {
  const v = entry?.max_pages;
  if (Number.isInteger(v) && v > 0) return Math.min(v, MAX_PAGES_CAP);
  return DEFAULT_MAX_PAGES;
}

// Guards against a doubled marker when the board already spells the work model
// into the location itself ("Berlin (Hybrid)", "Hybrid - London").
const HYBRID_MARKER = /\bhybrid\b/i;

/**
 * Normalize a single EchoJobs feed item. Exported for tests.
 *

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. For direct callers, pass only https://echojobs.io/... URLs.
2. For normal fetch() use, no action — the host is constant.
3. If seen in production, FEED_BASE was edited or the URL is being sourced from config (which would be a deliberate API change).

Example fix

// before
assertEchojobsUrl('https://evil.example.com/api/jobs?page=1');

// after
assertEchojobsUrl('https://echojobs.io/api/jobs?page=1');

function isEchojobsHost(u) { try { return new URL(u).hostname === 'echojobs.io'; } catch { return false; } }

function isEchojobsEndpoint(u) {
  if (typeof u !== 'string' || !u) return false;
  try {
    const p = new URL(u);
    return p.protocol === 'https:' && p.hostname === 'echojobs.io';
  } catch { return false; }
}

try { assertEchojobsUrl(url); }
catch (e) {
  if (/^echojobs: untrusted hostname/.test(e.message)) { /* wrong host — skip, do not follow */ }
  else throw e;
}

When it happens

Trigger: assertEchojobsUrl is called directly with an https URL on a non-echojobs.io host. fetch() always uses the constant host, so no entry config produces this.

Common situations: A direct integration or test pointing at a mock/proxy host. Production scans cannot reach this branch.

Related errors

• comeet: untrusted hostname "${parsed.hostname}" — must be ${
• echojobs: invalid URL: ${url}
• echojobs: URL must use HTTPS: ${url}
• eightfold: untrusted hostname "${parsed.hostname}" — must ma
• comeet: invalid URL: ${redactToken(url)}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/0411ac16280702d3. Report an issue: GitHub.