Underscores are valid characters in domain names, so don't prohibit them in trustedHosts[].
Also the domain name should be validated before creating the list with an invalid entry.