santifer/career-ops · error · Error

itviec: untrusted hostname

Error message

itviec: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}

What it means

Like the himalayas provider, assertItviecUrl allowlists a single trusted hostname (TRUSTED_HOST, itviec.com / www.itviec.com). If the URL parses and is https but its hostname does not exactly equal TRUSTED_HOST, this error is thrown — an SSRF guard pinning all requests to itviec.

Solutions

1. Use the exact TRUSTED_HOST hostname in the URL (https://www.itviec.com/...)
2. For tests, stub/override TRUSTED_HOST rather than passing localhost URLs through the validator
3. Fix typos or remove misconfigured portals.yml entries pointing at non-itviec hosts

Example fix

// before
assertItviecUrl('https://jobs.itviec.example.com/it-jobs');
// after
assertItviecUrl('https://www.itviec.com/it-jobs');

function isTrustedItviecUrl(url, trusted = TRUSTED_HOST) {
  try {
    const u = new URL(url);
    return u.protocol === 'https:' && u.hostname === trusted;
  } catch { return false; }
}
// pre-check: if (!isTrustedItviecUrl(entry.careers_url)) skip entry;

const hasTrustedHost = (u, host) => { try { return new URL(u).hostname === host; } catch { return false; } };

try {
  assertItviecUrl(url);
} catch (err) {
  if (/untrusted hostname/.test(err.message)) {
    console.warn(`non-itviec host rejected (SSRF guard): ${err.message}`);
    return null;
  }
  throw err;
}

When it happens

Trigger: The hostname after parsing differs from TRUSTED_HOST: subdomains not on the allowlist (m.itviec.com), lookalike domains (itviec.com.evil.io), or a mock host (localhost) in tests.

Common situations: Portals.yml entry points to a mirror or aggregator domain instead of itviec itself; test harness injects a local server URL without stubbing TRUSTED_HOST; a typo like itviiec.com.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• himalayas: untrusted hostname
• flowxtra: untrusted hostname
• flowxtra: URL must use HTTPS
• itviec: URL must use HTTPS
• jobbankca: invalid URL

AI-assisted analysis of santifer/career-ops@aac998c7ed (2026-09-16). Data as JSON: /api/errors/f969d9577e91b261. Report an issue: GitHub.

Appendix: source

Thrown at providers/itviec.mjs:86

  /(?:Posted|Đăng)\s*:?\s*(?:<\/\w+>\s*)?([^.<]{0,40}?(?:ago|trước)|today|hôm nay)/i;

/** @param {any} ctx @param {number} ms */
function sleep(ctx, ms) {
  if (typeof ctx?.sleep === 'function') return ctx.sleep(ms);
  return new Promise((r) => setTimeout(r, ms));
}

/** @param {string} url */
function assertItviecUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`itviec: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`itviec: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`itviec: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

/**
 * Collapse a markup fragment to its visible text.
 * @param {string} fragment
 * @returns {string}
 */
export function visibleText(fragment) {
  return decodeEntities(
    String(fragment ?? '')
      .replace(/<!--[\s\S]*?-->/g, ' ')
      .replace(/<[^>]+>/g, ' '),
  )
    .replace(/\s+/g, ' ')
    .trim();
}

View on GitHub (pinned to aac998c7ed)