santifer/career-ops · error · Error

solidjobs: untrusted hostname "${parsed.hostname}" — must be

Error message

solidjobs: untrusted hostname "${parsed.hostname}" — must be solid.jobs

What it means

assertUrl's third check requires the hostname to be exactly in ALLOWED_HOSTS, which contains only the bare apex 'solid.jobs'. Any other host — including 'www.solid.jobs' or a subdomain — is rejected as untrusted. This is an SSRF pin: only the canonical API host may be fetched.

Source

Thrown at providers/solidjobs.mjs:29

/**
 * Validates that the provided URL is a trusted SolidJobs API endpoint.
 * Enforces HTTPS protocol, strict hostname matching, and required path prefix.
 * 
 * @param {string} url - The URL string to validate.
 * @returns {string} The validated URL string.
 * @throws {Error} If the URL is malformed, uses non-HTTPS, has an untrusted host, or wrong path.
 */
function assertUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`solidjobs: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`solidjobs: URL must use HTTPS: ${url}`);
  if (!ALLOWED_HOSTS.has(parsed.hostname))
    throw new Error(`solidjobs: untrusted hostname "${parsed.hostname}" — must be solid.jobs`);
  if (!parsed.pathname.startsWith('/public-api/offers/'))
    throw new Error(`solidjobs: URL path must start with /public-api/offers/: ${url}`);
  return url;
}

/** @type {Provider} */
export default {
  id: 'solidjobs',

  /**
   * Attempts to detect if the provider can handle the given entry by checking the careers_url.
   * * @param {{ careers_url?: string, name?: string }} entry - The configuration entry.
   * @returns {{url: string} | null} An object with the matched URL, or null if not matched.
   */
  detect(entry) {
    const url = entry.careers_url || '';
    try {
      const parsed = new URL(url);

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Use the bare apex: https://solid.jobs/public-api/offers/<division> (no www, no subdomain)
2. Remove any trailing port or userinfo from the URL
3. If you genuinely need a different SolidJobs host, it is unsupported — file an issue rather than widening ALLOWED_HOSTS without review

Example fix

# before
careers_url: https://www.solid.jobs/public-api/offers/it
# after
careers_url: https://solid.jobs/public-api/offers/it

// Pin the solidjobs host before fetch.
function isSolidJobsHost(v) {
  try { return new URL(v).hostname === 'solid.jobs'; } catch { return false; }
}
if (!isSolidJobsHost(entry.careers_url)) {
  console.warn(`${entry.name}: solidjobs requires hostname solid.jobs (no www/subdomain)`);
}

When it happens

Trigger: entry.careers_url hostname is 'www.solid.jobs', a regional subdomain, or an entirely different host that happens to serve a similar path. The bare apex solid.jobs is the only accepted value.

Common situations: A user copies a URL from the browser address bar that includes 'www.', or pastes a look-alike/aggregator domain. The provider intentionally does not allow subdomains.

Related errors

• teamtailor: untrusted hostname "${parsed.hostname}" — must b
• solidjobs: invalid URL: ${url}
• solidjobs: URL must use HTTPS: ${url}
• solidjobs: URL path must start with /public-api/offers/: ${u
• tkms: cannot resolve jobs host for ${entry.name}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/95705e26b2157680. Report an issue: GitHub.