DIYgod/RSSHub · warning

Invalid subdomain

Error message

Invalid subdomain

What it means

Thrown by the booth-pm shop route when the `subdomain` path parameter fails isValidHost. The value is interpolated into `https://${subdomain}.booth.pm`, so it must be a single safe DNS label.

Source

Thrown at lib/routes-deprecated/booth-pm/shop.js:9

const got = require('@/utils/got');
const cheerio = require('cheerio');
const { isValidHost } = require('@/utils/valid-host');
const maxPages = 5;

module.exports = async (ctx) => {
    const { subdomain } = ctx.params;
    if (!isValidHost(subdomain)) {
        throw new Error('Invalid subdomain');
    }
    const shopUrl = `https://${subdomain}.booth.pm`;

    let shopName;
    const items = [];
    for (let page = 1; page <= maxPages; page++) {
        const pageUrl = `${shopUrl}/items?page=${page}`;
        // eslint-disable-next-line no-await-in-loop
        const response = await got({
            method: 'get',
            url: pageUrl,
        });

        const data = response.data;

        const $ = cheerio.load(data);
        shopName = $('div.shop-name > span').text();
        const pageItems = $('li.item');

View on GitHub (pinned to bed535e087)

Solutions

  1. Pass only the leading subdomain label (e.g. 'shop' for shop.booth.pm).
  2. Strip any protocol or trailing path before submitting.
  3. Confirm the shop subdomain exists on booth.pm.

Example fix

// before
/booth/pm/shop/shop.booth.pm
// after
/booth/pm/shop/shop
Defensive patterns

Strategy: validation

Validate before calling

import { isValidHost } from '@/utils/valid-host';
if (!isValidHost(subdomain)) throw new Error('Invalid subdomain');

Type guard

const isSafeSubdomain = (v: unknown): boolean =>
  typeof v === 'string' && /^[a-z0-9-]+$/i.test(v) && !v.includes('.');

Prevention

When it happens

Trigger: Request to /booth/pm/shop/:subdomain with a subdomain containing dots, slashes, protocol characters, or other invalid host characters.

Common situations: User passes the full shop URL instead of the label; passes 'shop.booth.pm' instead of 'shop'; attempts traversal via '../'.

Related errors

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/a05065d4cd100990. Report an issue: GitHub.