santifer/career-ops · error · Error

larajobs: untrusted hostname

Error message

larajobs: untrusted hostname "${parsed.hostname}" - must be ${TRUSTED_HOST}

What it means

assertLarajobsUrl pins the hostname to a single TRUSTED_HOST. An HTTPS URL aimed at any other hostname — including subdomain variants or mirrors — is rejected with this error listing the offending hostname and the required one.

Solutions

1. Set the hostname to exactly TRUSTED_HOST (check the constant in providers/larajobs.mjs).
2. Remove any 'www.' prefix or correct the TLD in the URL/config.
3. Don't bypass for tests — the pin is an SSRF guard; use a sanctioned configuration point instead.
4. Compare the parsed hostname printed in the error with the expected constant to identify the exact mismatch.

Example fix

// before
assertLarajobsUrl('https://www.larajobs.com/api/jobs');
// after
assertLarajobsUrl('https://larajobs.com/api/jobs');

const TRUSTED_HOST = 'larajobs.com';
function isTrustedHost(u) { try { return new URL(u).hostname === TRUSTED_HOST; } catch { return false; } }
if (!isTrustedHost(url)) throw new Error(`larajobs host not allowed: ${url}`);

function isTrustedUrl(v) { if (typeof v !== 'string') return false; try { return new URL(v).hostname === TRUSTED_HOST && new URL(v).protocol === 'https:'; } catch { return false; } }

try {
  provider.fetch(entry, ctx);
} catch (e) {
  if (e.message.includes('untrusted hostname')) {
    console.error(`larajobs entry points at wrong host: ${e.message}`);
    return null;
  }
  throw e;
}

When it happens

Trigger: Passing an https URL whose parsed hostname !== TRUSTED_HOST, e.g. 'https://www.larajobs.com/...', a different TLD, or a proxy/mock host substituted for testing.

Common situations: Config pointing at a corporate proxy, 'www.' prefix added by hand, typo in TLD (.io vs .com), or swapping the endpoint for a staging server without realizing the allowlist.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• landingjobs: untrusted hostname
• lever: untrusted hostname
• pythonorg: untrusted hostname
• torre: untrusted hostname
• weworkremotely: untrusted hostname

AI-assisted analysis of santifer/career-ops@aac998c7ed (2026-09-16). Data as JSON: /api/errors/de721dc69a08c9a2. Report an issue: GitHub.

Appendix: source

Thrown at providers/larajobs.mjs:29

// `<job:company>` and `<job:location>`, so company and location come straight
// from the feed (no title-splitting heuristics needed).
//
// Wire in via a `job_boards:` entry with `provider: larajobs`.

const FEED_URL = 'https://larajobs.com/feed';
const TRUSTED_HOST = 'larajobs.com';

/** @param {string} url */
function assertLarajobsUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`larajobs: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`larajobs: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`larajobs: untrusted hostname "${parsed.hostname}" - must be ${TRUSTED_HOST}`);
  }
  return url;
}

// NaN-safe Date.parse - `|| undefined` would also coerce a valid epoch 0.
function toEpochMs(value) {
  if (!value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;
}

function fallbackCompany(entry) {
  return typeof entry?.name === 'string' && entry.name.trim() ? entry.name.trim() : 'LaraJobs';
}

/** @type {Provider} */
export default {
  id: 'larajobs',

View on GitHub (pinned to aac998c7ed)