santifer/career-ops · error · Error

themuse: untrusted hostname "${parsed.hostname}" — must be $

Error message

themuse: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}

What it means

assertMuseUrl's third check requires the hostname to equal TRUSTED_HOST ('www.themuse.com') exactly. It is an SSRF pin over the hardcoded FEED_BASE; like the other themuse guards it is unreachable from config and only fires if FEED_BASE/TRUSTED_HOST are edited or the function is called externally.

Source

Thrown at providers/themuse.mjs:24

// Response shape: { results: [...], page: n, page_count: N }
// All pages are fetched sequentially and aggregated before normalizing.
//
// Wire in via a `job_boards:` entry with `provider: themuse`.

const FEED_BASE = 'https://www.themuse.com/api/public/jobs';
const TRUSTED_HOST = 'www.themuse.com';

/** @param {string} url */
function assertMuseUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`themuse: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`themuse: URL must use HTTPS: ${url}`);
  if (parsed.hostname !== TRUSTED_HOST) {
    throw new Error(`themuse: untrusted hostname "${parsed.hostname}" — must be ${TRUSTED_HOST}`);
  }
  return url;
}

/**
 * Normalize a single result from the Muse API response. Exported for unit tests.
 *
 * Field mapping:
 *   name              → title
 *   refs.landing_page → url
 *   company.name      → company
 *   locations[0].name → location
 *
 * Returns null when required fields (title or url) are missing or invalid.
 *
 * @param {any} j
 * @returns {{ title: string, url: string, company: string, location: string } | null}
 */

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Restore both FEED_BASE and TRUSTED_HOST to their shipped values (https://www.themuse.com/api/public/jobs and www.themuse.com)
2. If retargeting, keep TRUSTED_HOST in sync with the FEED_BASE hostname

// Keep TRUSTED_HOST and FEED_BASE hostname in sync.
if (new URL(FEED_BASE).hostname !== TRUSTED_HOST) {
  throw new Error('themuse: FEED_BASE hostname does not match TRUSTED_HOST');
}

When it happens

Trigger: FEED_BASE was changed to a host other than www.themuse.com without updating TRUSTED_HOST, or TRUSTED_HOST was changed but FEED_BASE was not (or vice versa).

Common situations: A fork retargets the feed but updates only one of the two constants, breaking the pairing.

Related errors

• themuse: invalid URL: ${url}
• themuse: URL must use HTTPS: ${url}
• smartrecruiters: untrusted hostname "${parsed.hostname}" — m
• solidjobs: untrusted hostname "${parsed.hostname}" — must be
• teamtailor: untrusted hostname "${parsed.hostname}" — must b

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/58dc042d93f9116e. Report an issue: GitHub.