DIYgod/RSSHub · error · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

Thrown as a `ConfigNotFoundError` when the user-supplied Fediverse domain is not in the allowed-domain set AND the `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN` feature flag is not enabled. This is an SSRF defense: without it, any user could make RSSHub fetch from arbitrary domains via the webfinger and ActivityPub endpoints. The allowed set includes `mastodon.social`, `pawoo.net`, and the configured `config.mastodon.apiHost`.

Source

Thrown at lib/routes/fediverse/timeline.ts:41

    },
    name: 'Timeline',
    maintainers: ['DIYgod', 'pseudoyu'],
    handler,
};

const allowedDomain = new Set(['mastodon.social', 'pawoo.net', config.mastodon.apiHost].filter(Boolean));
const activityPubTypes = new Set(['application/activity+json', 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"']);

async function handler(ctx) {
    const account = ctx.req.param('account');
    const domain = account.split('@', 2)[1];
    const username = account.split('@', 1)[0];

    if (!domain || !username) {
        throw new InvalidParameterError('Invalid account');
    }
    if (!config.feature.allow_user_supply_unsafe_domain && !allowedDomain.has(domain.toLowerCase())) {
        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }

    const requestOptions = {
        headers: {
            Accept: 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
        },
    };

    const acc = await ofetch(`https://${domain}/.well-known/webfinger?resource=acct:${account}`, {
        headers: {
            Accept: 'application/jrd+json',
        },
    });
    const jsonLink = acc.links.find((link) => link.rel === 'self' && activityPubTypes.has(link.type))?.href;
    const link = acc.links.find((link) => link.rel === 'http://webfinger.net/rel/profile-page')?.href;
    const officialFeed = await parser.parseURL(`${link}.rss`);

    if (officialFeed) {

View on GitHub (pinned to bed535e087)

Solutions

1. Set the `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true` environment variable if you trust your users and understand the SSRF risk.
2. Alternatively, add the desired domain to `config.mastodon.apiHost` or extend the `allowedDomain` Set in the route file.
3. Use an allowlisted domain (mastodon.social or pawoo.net) if you only need those instances.
4. If you are the end user on a public instance, ask the operator to allowlist your instance or self-host.

const ALLOWED_DOMAINS = new Set(['mastodon.social', 'pawoo.net', config.mastodon.apiHost].filter(Boolean));

function validateFediverseDomain(domain: string): void {
    if (!config.feature.allow_user_supply_unsafe_domain && !ALLOWED_DOMAINS.has(domain.toLowerCase())) {
        throw new ConfigNotFoundError(`Domain '${domain}' is not allowed. Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true or use an allowed instance.`);
    }
}

function isAllowedDomain(domain: string): boolean {
    return config.feature.allow_user_supply_unsafe_domain ||
        ALLOWED_DOMAINS.has(domain.toLowerCase());
}

When it happens

Trigger: A user requests `/fediverse/timeline/user@some-mastodon-instance.example` where the domain is not mastodon.social, pawoo.net, or the configured apiHost. The `config.feature.allow_user_supply_unsafe_domain` flag is false (the default), so the ConfigNotFoundError fires before any outbound request.

Common situations: Self-hosted RSSHub where the operator wants to follow users on a non-allowlisted instance (e.g., a private Mastodon, a GoToSocial, or an Akkoma server). The operator has not set `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true` in the environment. A public RSSHub instance correctly rejects the request for security.

Related errors

• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/4a1703c57f2c899a. Report an issue: GitHub.