DIYgod/RSSHub · error · InvalidParameterError
Invalid uid
Error message
Invalid uid
What it means
Thrown by the ZCOOL user route when the `:uid` path parameter is non-numeric (so it is treated as a personal-domain subdomain prefix) but fails `isValidHost`. The route accepts either a numeric user ID (`/zcool/user/568339`) or a subdomain-style alias (`/zcool/user/baiyong`); a value that is neither a number nor a valid host label is rejected.
Source
Thrown at lib/routes/zcool/user.ts:48
target: '/user/:id',
},
],
name: '用户作品',
description: `例如:
站酷的个人主页 \`https://baiyong.zcool.com.cn\` 对应 rss 路径 \`/zcool/user/baiyong\`
站酷的个人主页 \`https://www.zcool.com.cn/u/568339\` 对应 rss 路径 \`/zcool/user/568339\``,
maintainers: ['junbaor'],
handler,
};
async function handler(ctx) {
const uid = ctx.req.param('uid');
let pageUrl = `https://www.zcool.com.cn/u/${uid}`;
if (Number.isNaN(uid)) {
if (!isValidHost(uid)) {
throw new InvalidParameterError('Invalid uid');
}
pageUrl = `https://${uid}.zcool.com.cn`;
}
const { data: response } = await got(pageUrl);
const $ = load(response);
const data = JSON.parse($('script#__NEXT_DATA__').text());
const workList = data.props.pageProps.workList.map((item) => ({
title: item.title,
link: item.pageUrl,
pubDate: parseDate(item.publishTime, 'x'),
category: [item.objectTypeStr, item.cateStr, item.subCateStr, ...item.tags],
}));
const items = await Promise.all(
workList.map((item) =>
cache.tryGet(item.link, async () => {
const { data: response } = await got(item.link);View on GitHub (pinned to bed535e087)
Solutions
- Use only the bare alias or numeric ID: `/zcool/user/baiyong` or `/zcool/user/568339`.
- If you have a full profile URL, extract the subdomain prefix (`baiyong` from `baiyong.zcool.com.cn`) or the numeric segment before calling the route.
- Strip any leading/trailing slashes or protocol before passing the value as `uid`.
Example fix
// before — caller passes a full URL segment // GET /zcool/user/https://baiyong.zcool.com.cn -> Invalid uid // after — pass the bare alias or numeric id // GET /zcool/user/baiyong // GET /zcool/user/568339
Defensive patterns
Strategy: validation
Validate before calling
function normalizeZcoolUid(raw) {
// numeric id
if (/^\d+$/.test(raw)) return raw;
// subdomain alias extracted from a full URL
const m = raw.match(/^(?:https?:\/\/)?([a-z0-9-]+)\.zcool\.com\.cn/i);
if (m) return m[1];
// bare alias
if (/^[a-z0-9-]+$/i.test(raw)) return raw;
throw new Error(`Invalid zcool uid: ${raw}`);
} Type guard
function isValidZcoolUid(uid: string): boolean {
return /^\d+$/.test(uid) || /^[a-z0-9-]+$/i.test(uid);
} Prevention
- Validate the uid is either all-digits or a clean host label before constructing the route URL.
- If accepting user-pasted URLs, extract the subdomain or numeric segment server-side rather than passing the raw string.
- Strip leading/trailing slashes and protocol prefixes before validation.
When it happens
Trigger: The caller supplies a `uid` that is not all-digits and is not a valid DNS host label — e.g. contains slashes, spaces, dots, or special characters; or a copy-paste of a full URL instead of the bare alias.
Common situations: User pastes `https://baiyong.zcool.com.cn` or `www.zcool.com.cn/u/568339` into the path instead of just `baiyong` / `568339`; a malformed client request injects unexpected characters into the param.
Related errors
AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12).
Data as JSON: /api/errors/be510e5adc98b303.
Report an issue: GitHub.