What causes "Invalid city" in DIYgod/RSSHub?

Use the documented two-letter city slug (sh, gz, sz, bj, etc.) from the route description; see http://www.bendibao.com/city.htm for the full list.

DIYgod/RSSHub · warning · InvalidParameterError

Invalid city

Error message

Invalid city

What it means

InvalidParameterError thrown by the bendibao news route when the :city parameter fails isValidHost, i.e. the city slug would not form a valid bendibao subdomain ({city}.bendibao.com). It guards against bogus or malicious host values before constructing the request URL.

Source

Thrown at lib/routes/bendibao/news.ts:48

    maintainers: ['nczitzk'],
    handler,
    url: 'bendibao.com/',
    description: `| 城市名 | 缩写 |
| ------ | ---- |
| 北京   | bj   |
| 上海   | sh   |
| 广州   | gz   |
| 深圳   | sz   |

更多城市请参见 [这里](http://www.bendibao.com/city.htm)

> **香港特别行政区** 和 **澳门特别行政区** 的本地宝城市页面不更新资讯。`,
};

async function handler(ctx) {
    const city = ctx.req.param('city');
    if (!isValidHost(city)) {
        throw new InvalidParameterError('Invalid city');
    }

    const rootUrl = `http://${city}.bendibao.com`;

    let response = await got({
        method: 'get',
        url: rootUrl,
    });

    let $ = load(response.data);
    const title =
        $('title')
            .text()
            .replace(/-爱上本地宝，生活会更好/, '') + '焦点资讯';

    let items = $('ul.focus-news li')
        .toArray()
        .map((item): DataItem => {

View on GitHub (pinned to bed535e087)

Solutions

Use the documented two-letter city slug (sh, gz, sz, bj, etc.) from the route description; see http://www.bendibao.com/city.htm for the full list.
Note HK and MO are intentionally unsupported because their bendibao pages do not carry news.

Defensive patterns

Strategy: validation

Validate before calling

const city = ctx.req.param('city');
if (!isValidHost(city)) {
    throw new InvalidParameterError('Invalid city');
}

Type guard

import { isValidHost } from '@/utils/valid-host';
function isCitySlug(v: unknown): boolean {
    return typeof v === 'string' && isValidHost(v);
}

Prevention

Always pass user-supplied host segments through isValidHost to prevent SSRF.
Document the slug (not the display name) and note HK/MO are intentionally unsupported.

When it happens

Trigger: Calling /bendibao/news/:city with a city value that is not a valid DNS label (contains dots, slashes, is empty, or is otherwise disallowed by isValidHost).

Common situations: User passes a city name in Chinese characters instead of the slug (e.g. '上海' instead of 'sh'); user passes a full URL; user passes a non-existent city slug.

Related errors

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/acea9bd9488072c3. Report an issue: GitHub.