santifer/career-ops · error · Error

nodesk: untrusted hostname "${parsed.hostname}" - must be ${

Error message

nodesk: untrusted hostname "${parsed.hostname}" - must be ${TRUSTED_HOST}

What it means

Thrown by nodesk's assertNodeskUrl() when the parsed URL's hostname is not exactly 'nodesk.co' (the TRUSTED_HOST constant). This is the third and final SSRF gate, ensuring the request stays on the legitimate nodesk.co origin regardless of redirects. It prevents DNS-rebinding and open-redirect-based SSRF by pinning the hostname before the fetch.

Source

Thrown at providers/nodesk.mjs:24

// and XML, so it is parsed in-process with the same tiny tag extractor
// approach as providers/personio.mjs rather than adding an XML dependency.
//
// Wire in via a `job_boards:` entry with `provider: nodesk`.

const FEED_URL = 'https://nodesk.co/remote-jobs/index.xml';
const TRUSTED_HOST = 'nodesk.co';

/** @param {string} url */
function assertNodeskUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`nodesk: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`nodesk: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`nodesk: untrusted hostname "${parsed.hostname}" - must be ${TRUSTED_HOST}`);
  }
  return url;
}

// NaN-safe Date.parse - `|| undefined` would also coerce a valid epoch 0.
function toEpochMs(value) {
  if (!value) return undefined;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? undefined : parsed;
}

function fallbackCompany(entry) {
  return typeof entry?.name === 'string' && entry.name.trim() ? entry.name.trim() : 'NoDesk';
}

/** @type {Provider} */
export default {
  id: 'nodesk',

View on GitHub (pinned to 9b17a8ac97)

Solutions

Set the URL hostname to exactly 'nodesk.co' — remove any subdomain like www., api., or feed..
If a subdomain variant is legitimately needed (e.g. api.nodesk.co), update the TRUSTED_HOST constant or switch to a hostname allowlist Set like other providers use.
Verify the entry was not copy-pasted from a different provider block — the provider field and URL domain must match.

Example fix

// before
const TRUSTED_HOST = 'nodesk.co';
// entry has: https://www.nodesk.co/remote-jobs/index.xml
// → throws: untrusted hostname "www.nodesk.co"

// after — either fix the URL to drop www, or allowlist variants:
const TRUSTED_HOSTS = new Set(['nodesk.co', 'www.nodesk.co']);
if (!TRUSTED_HOSTS.has(parsed.hostname)) {
  throw new Error(`nodesk: untrusted hostname "${parsed.hostname}" - must be nodesk.co`);
}

Defensive patterns

Strategy: validation

Validate before calling

const TRUSTED_HOST = 'nodesk.co';

/** Check hostname matches the trusted host before calling the provider. */
function isTrustedNodeskUrl(url) {
  try {
    return new URL(url).hostname === TRUSTED_HOST;
  } catch {
    return false;
  }
}

if (!isTrustedNodeskUrl(entry.api)) {
  console.warn(`nodesk entry ${entry.name} has untrusted host`);
  continue;
}

Type guard

/** @param {string} url @returns {boolean} */
function isNodeskHost(url) {
  try { return new URL(url).hostname === 'nodesk.co'; } catch { return false; }
}

Try / catch

try {
  await nodeskProvider.fetch(entry, ctx);
} catch (err) {
  if (String(err.message).includes('untrusted hostname')) {
    console.warn(`nodesk entry ${entry.name} points to wrong host — fix portals.yml`);
    continue;
  }
  throw err;
}

Prevention

Ensure portal URLs use exactly 'nodesk.co' without subdomains.
Run a config audit that checks each provider entry's URL hostname against the provider's trusted host.
Document the exact allowed hostname(s) per provider in a config reference.

When it happens

Trigger: The URL is valid and HTTPS but points to a different host: e.g. 'https://www.nodesk.co/...' (note the www subdomain), 'https://evil.com/...' or 'https://nodesk.co.evil.com/...'. Also triggered by a misconfigured careers_url that has been changed to a proxy, a mirror, or a different job board domain entirely. The strict equality check rejects any subdomain variant.

Common situations: Someone adds 'www.' to the hostname (www.nodesk.co). The entry was copied from another provider and the domain wasn't updated. A well-meaning admin pointed the URL at a caching proxy or corporate gateway on a different domain. DNS-rebinding attacks where an attacker-controlled hostname resolves to an internal IP are blocked here.

Related errors

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/91274b60048cc9b0. Report an issue: GitHub.