DIYgod/RSSHub · warning · InvalidParameterError

Invalid site

Error message

Invalid site

What it means

Thrown as an `InvalidParameterError` when the `site` path parameter fails the `isValidHost()` validation. The site value is used to construct the root URL `http://${site}.people.com.cn`. The `isValidHost` utility checks whether the site string is a syntactically valid hostname component, preventing SSRF and malformed URLs.

Source

Thrown at lib/routes/people/index.ts:28

import { isValidHost } from '@/utils/valid-host';

export const route: Route = {
    path: '/:site?/:category{.+}?',
    name: '首页头条',
    maintainers: ['nczitzk', 'pseudoyu'],
    example: '/people',
    handler,
};

async function handler(ctx) {
    const { site = 'www' } = ctx.req.param();
    const { category: requestedCategory = site === 'www' ? '59476' : '' } = ctx.req.param();
    const category = site === 'cpc' && requestedCategory === '24h' ? '64093/64387' : requestedCategory;

    const limit = ctx.req.query('limit') ? Number(ctx.req.query('limit')) : 30;

    if (!isValidHost(site)) {
        throw new InvalidParameterError('Invalid site');
    }
    const rootUrl = `http://${site}.people.com.cn`;
    const path = site === 'politics' && !category ? 'GB/1024' : site === 'society' && category === '1008' ? '' : category ? `GB/${category}` : '';
    const requestedUrl = new URL(path, rootUrl).href;
    const { $, url: currentUrl } = await fetchChannel(requestedUrl);
    const articleRootUrl = new URL('/', currentUrl).href;

    $('em').remove();
    $('.bshare-more, .page_n, .page').remove();

    $('a img, h3 img').each((_, e) => {
        $(e).parent().remove();
    });

    let items = $('.p6, div.p2j_list, div.headingNews, div.ej_list_box, .leftItem, div.p2j_con02 > div.fl, div.jsnew_line')
        .find('a')
        .slice(0, limit)
        .toArray()

View on GitHub (pinned to bed535e087)

Solutions

1. Use a valid People's Daily subdomain label like 'www', 'cpc', 'politics', 'society' (just the subdomain prefix, not a full URL).
2. Omit the site parameter entirely to default to 'www'.
3. Check the `isValidHost` utility in `@/utils/valid-host` for exact validation rules.

// Validate site before constructing the URL
import { isValidHost } from '@/utils/valid-host';
if (!isValidHost(site)) {
    throw new InvalidParameterError(`Invalid site '${site}'. Use a valid subdomain label like 'www', 'cpc', 'politics'.`);
}

function isValidPeopleSite(site: string): boolean {
    return isValidHost(site);
}

When it happens

Trigger: Requesting `/people/<site>/...` with a site value that is not a valid hostname label — containing special characters, dots, spaces, or other invalid characters. Examples: `site='evil.com'`, `site='a.b'`, `site='../'`.

Common situations: User passes a malformed site value. An attacker attempts path traversal or SSRF via the site parameter. User misunderstands the parameter as a full URL rather than a subdomain label.

Related errors

• Invalid forum id '${fid}'
• Invalid state '${state}'
• Invalid type parameter
• 暂不支持对${type}的订阅
• 暂不支持对${type}的订阅

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/6e35ca97a7da4774. Report an issue: GitHub.