DIYgod/RSSHub · error · Error

Account should not contain "://" or path components

Error message

Account should not contain "://" or path components

What it means

The RSS3 route takes an `:account` path parameter that is interpolated directly into `https://gi.rss3.io/decentralized/${account}?...`. To prevent path/host injection (a crafted account like `evil.com/x` would redirect the request to a different host) the handler rejects any value containing `://` or `/`. This is a security boundary, not a usability check.

Source

Thrown at lib/routes/rss3/index.ts:128

                {
                    value: 'transaction',
                    label: 'transaction',
                },
                {
                    value: 'unknown',
                    label: 'unknown',
                },
            ],
        },
    },
};

async function handler(ctx) {
    const { account, network, tag } = ctx.req.param();

    // Check if account contains "://" or "/"
    if (account.includes('://') || account.includes('/')) {
        throw new Error('Account should not contain "://" or path components');
    }

    const { data } = await ofetch(
        `https://gi.rss3.io/decentralized/${account}?${new URLSearchParams({
            limit: '20',
            ...(network && network !== 'all' && { network }),
            ...(tag && tag !== 'all' && { tag }),
        })}`
    );

    return {
        title: `${account} activities`,
        link: 'https://rss3.io',
        item: data.map((item) => {
            const content = renderItemActionToHTML(camelcaseKeys(item.actions));

            const description = `New ${item.tag} ${item.type} action on ${item.network}<br /><br />From: ${item.from}<br/>To: ${item.to}`;
            return {

View on GitHub (pinned to bed535e087)

Solutions

1. Pass only the bare account identifier (the RSS3 handle/EVM address), not a URL. Example: /rss3/vitalik.eth/ethereum.
2. URL-decode the input before routing if your client double-encodes slashes.
3. If you genuinely need a path-style account, this route does not support it — file an upstream feature request instead of bypassing the guard.

Example fix

// before
/rsshub/rss3/https%3A%2F%2Fmy.eth/ethereum

// after
/rsshub/rss3/my.eth/ethereum

const account = ctx.req.param('account');
if (account.includes('://') || account.includes('/')) {
    return ctx.body('Account must be a bare identifier, not a URL or path.', 400);
}

const isBareAccount = (v: unknown): v is string =>
    typeof v === 'string' && !v.includes('://') && !v.includes('/');

When it happens

Trigger: A request like /rss3/https%3A%2F%2Fevil.com/x/ethereum or /rss3/foo/bar where the account segment itself contains a slash or scheme separator. The guard throws before the ofetch call.

Common situations: URL-encoded slashes leaking into the account segment; user pastes a full profile URL into the account slot; misconfigured reverse proxy does not collapse path segments.

Related errors

• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• ${type} is not supported
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• Invalid type

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/de2c369fdfaa06a1. Report an issue: GitHub.