What causes "Invalid section name" in DIYgod/RSSHub?

DIYgod/RSSHub · error · InvalidParameterError

Invalid section name

Error message

Invalid section name

What it means

Thrown as an InvalidParameterError when the optional `section` path parameter on the Slashdot route is present but fails the isValidHost() check. isValidHost validates the string against a DNS-label regex (/^[\dA-Z](?:[\dA-Z-]{0,61}[\dA-Z])?$/i) ensuring it is a syntactically valid subdomain label. This prevents the handler from constructing a URL like https://<malicious>.slashdot.org or https://<invalid>.slashdot.org that could cause request errors or SSRF.

Source

Thrown at lib/routes/slashdot/index.ts:52

        {
            source: ['science.slashdot.org'],
            target: '/science',
        },
        {
            source: ['yro.slashdot.org'],
            target: '/yro',
        },
    ],
    name: 'News',
    maintainers: ['TonyRL'],
    handler,
};

async function handler(ctx) {
    const { section } = ctx.req.param();

    if (section && !isValidHost(section)) {
        throw new InvalidParameterError('Invalid section name');
    }

    const link = section ? `https://${section}.slashdot.org` : 'https://slashdot.org';
    const response = await ofetch(link);
    const $ = load(response);

    const list = $('.article')
        .toArray()
        .map((item) => {
            const $item = $(item);
            const a = $item.find('.story-title a').first();
            const details = $item.find('.details');

            return {
                title: a.text(),
                link: a.attr('href'),
                description: $item.find('.body').html(),
                pubDate: parseDate(

View on GitHub (pinned to bed535e087)

Solutions

Use a valid Slashdot section subdomain: devices, build, entertainment, technology, science, yro, or omit the section entirely for the main page.
Ensure the section contains only alphanumeric characters and hyphens, starts and ends with alphanumeric, and is 1-63 characters.
If no specific section is needed, request /slashdot with no path parameter.

Example fix

// before
GET /slashdot/tech_news

// after
GET /slashdot/technology

Defensive patterns

Strategy: validation

Validate before calling

const VALID_SECTIONS = ['devices', 'build', 'entertainment', 'technology', 'science', 'yro'];
const { section } = ctx.req.param();
if (section && !VALID_SECTIONS.includes(section)) {
    throw new InvalidParameterError(`Invalid section. Valid sections: ${VALID_SECTIONS.join(', ')}`);
}

Type guard

function isValidSlashdotSection(s: string | undefined): boolean {
    if (!s) return true; // empty is valid (main page)
    return isValidHost(s);
}

Prevention

Prefer an explicit allowlist of valid sections over the generic isValidHost regex, since only specific subdomains actually exist.
Include valid section names in the error message so users can self-correct.
Document the available sections in the route parameters description.

When it happens

Trigger: A GET to /slashdot/<section> where section contains characters not allowed in DNS labels: underscores, dots, spaces, special characters, or is an empty-looking encoded value. For example /slashdot/tech_news or /slashdot/foo.bar would fail the regex.

Common situations: User types a section name with an underscore or period (Slashdot sections are single DNS labels like 'devices', 'science', 'yro'); URL encoding produces unexpected characters; or a bot/scanner probes with arbitrary path segments.

Related errors

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/630e4596fc4c23b2. Report an issue: GitHub.