santifer/career-ops · error · Error

glints: untrusted hostname "${parsed.hostname}" — must be on

Error message

glints: untrusted hostname "${parsed.hostname}" — must be one of: ${[...ALLOWED_GLINTS_HOSTS].join(', ')}

What it means

glints.mjs throws this in assertGlintsUrl() when the URL is valid HTTPS but its hostname is not in ALLOWED_GLINTS_HOSTS ('glints.com', 'www.glints.com', 'glints.id'). It is the host-allowlist half of the SSRF guard for the operator-supplied entry.api; combined with redirect:'error' it keeps Glints requests on a known-good host.

Source

Thrown at providers/glints.mjs:79

      }
      createdAt
    }
    expInfo
    hasMore
  }
}`;

/** @param {string} url */
function assertGlintsUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`glints: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`glints: URL must use HTTPS: ${url}`);
  if (!ALLOWED_GLINTS_HOSTS.has(parsed.hostname))
    throw new Error(`glints: untrusted hostname "${parsed.hostname}" — must be one of: ${[...ALLOWED_GLINTS_HOSTS].join(', ')}`);
  return url;
}

// NaN-safe Date.parse
function toEpochMs(value) {
  if (!value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;
}

/**
 * Derive the job detail base URL from the API hostname.
 * @param {string} apiUrl
 * @returns {string}
 */
function deriveBaseUrl(apiUrl) {
  try {
    const parsed = new URL(apiUrl);

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Set api to one of the allowed hosts (https://glints.com/api/v2-alc/graphql) or omit api to use the default.
2. If a legitimate additional Glints host is needed, add it to ALLOWED_GLINTS_HOSTS in glints.mjs with justification.
3. Treat an unexpected hostname here as a possible config-injection/SSRF attempt and verify the source of the api value.

Example fix

# before
- name: Glints (ID)
  provider: glints
  api: https://glints-proxy.internal/graphql   # off-allowlist -> throws

# after
- name: Glints (ID)
  provider: glints
  api: https://glints.com/api/v2-alc/graphql   # (or omit api entirely)

// Pre-flight: ensure a Glints entry.api host is allowlisted (SSRF defense at config time).
const GLINTS_HOSTS = new Set(['glints.com','www.glints.com','glints.id']);
function glintsApiHostAllowed(entry) {
  const api = entry.api || 'https://glints.com/api/v2-alc/graphql';
  let u;
  try { u = new URL(api); } catch { return false; }
  return GLINTS_HOSTS.has(u.hostname);
}

When it happens

Trigger: entry.api is set to a host outside the allowlist (e.g. a regional mirror like https://glints.sg/... or a proxy host); a test calls assertGlintsUrl('https://evil.com/...'); an operator pointed api at a generic GraphQL proxy.

Common situations: Operator tries a regional Glints domain not yet in the allowlist; a corporate egress proxy host was used; a malicious/typo'd api value targets an internal host (the guard's purpose).

Related errors

• flowxtra: untrusted hostname "${parsed.hostname}" — must be
• gem: untrusted hostname "${parsed.hostname}" — must be one o
• getonbrd: untrusted hostname "${parsed.hostname}" — must be
• greenhouse: untrusted hostname "${parsed.hostname}" — must b
• gem: invalid URL: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/ecb72f81b62539a4. Report an issue: GitHub.