santifer/career-ops · error · Error

remotli: untrusted hostname "${parsed.hostname}" — must be r

Error message

remotli: untrusted hostname "${parsed.hostname}" — must be remotli.ch

What it means

assertRemotliUrl throws when parsed.hostname fails HOST_RE — the host must be exactly 'remotli.ch' (no subdomains, no branded variants). This is the strictest hostname guard in the set: remotli is a single fixed host, not a per-tenant subdomain provider. Any deviation is treated as an SSRF attempt.

Source

Thrown at providers/remotli.mjs:242

  if (postedAt !== undefined) out.postedAt = postedAt;

  const salary = resolveSalary(job);
  if (salary) out.salary = salary;

  return out;
}

/** Guard the API URL: HTTPS + remotli.ch only. */
function assertRemotliUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`remotli: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`remotli: URL must use HTTPS: ${url}`);
  if (!HOST_RE.test(parsed.hostname))
    throw new Error(`remotli: untrusted hostname "${parsed.hostname}" — must be remotli.ch`);
  return url;
}

/** @type {Provider} */
export default {
  id: 'remotli',

  detect(entry) {
    const raw = typeof entry.careers_url === 'string' ? entry.careers_url : '';
    if (!raw) return null;
    let parsed;
    try {
      parsed = new URL(raw);
    } catch {
      return null;
    }
    if (parsed.protocol !== 'https:') return null;
    if (!HOST_RE.test(parsed.hostname)) return null;

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Set ORIGIN to 'https://remotli.ch' with no subdomain prefix.
2. Strip any leading subdomain label from the hostname before validation.
3. Confirm the entry should use the remotli provider — if the board is on a different host, choose the right provider.

Example fix

// before
const ORIGIN = 'https://www.remotli.ch';
// after
const ORIGIN = 'https://remotli.ch';

const REMOTLI_HOST = 'remotli.ch';
function isRemotliHost(url) {
  try { return new URL(url).hostname === REMOTLI_HOST; } catch { return false; }
}
if (!isRemotliHost(someUrl)) {
  console.warn(`skip: not remotli.ch — got ${someUrl}`);
}

null

try {
  await provider.fetch(entry, ctx);
} catch (e) {
  if (/untrusted hostname/.test(e.message)) {
    console.error('[bug] remotli ORIGIN has a subdomain — must be exactly remotli.ch');
  } else throw e;
}

When it happens

Trigger: The hostname is www.remotli.ch, api.remotli.ch, a branded domain, or any host other than exactly remotli.ch; the URL points to a look-alike domain.

Common situations: Someone added a www. or api. prefix to the ORIGIN constant; a config value was copied from a browser address bar that included a subdomain; the entry was misrouted to remotli when it belongs elsewhere.

Related errors

• pinpoint: untrusted hostname "${parsed.hostname}" — must mat
• recruitee: untrusted hostname "${parsed.hostname}" — must ma
• rippling: untrusted hostname "${parsed.hostname}" — must be
• remotli: URL must use HTTPS: ${url}
• Refusing non-HTTP(S) URL: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/d1ff1deddf8eef1e. Report an issue: GitHub.