DIYgod/RSSHub · warning · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

Thrown as ConfigNotFoundError by the Misskey 'featured notes' route. RSSHub restricts which host a user may inject via the :site parameter to a fixed allow-list (utils.allowSiteList); any host not on the list is rejected unless the operator explicitly opted in by setting ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true. This is an SSRF guard — it stops arbitrary host injection through the route.

Source

Thrown at lib/routes/misskey/featured-notes.ts:31

    example: '/misskey/notes/featured/misskey.io',
    parameters: { site: 'instance address, domain only, without `http://` or `https://` protocol header' },
    features: {
        requireConfig: false,
        requirePuppeteer: false,
        antiCrawler: false,
        supportBT: false,
        supportPodcast: false,
        supportScihub: false,
    },
    name: 'Featured Notes',
    maintainers: ['Misaka13514'],
    handler,
};

async function handler(ctx) {
    const site = ctx.req.param('site');
    if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(site)) {
        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }

    // docs on: https://misskey-hub.net/docs/api/endpoints/notes/featured.html
    const url = `https://${site}/api/notes/featured`;
    const response = await got({
        method: 'post',
        url,
        json: {
            limit: 10,
            offset: 0,
        },
    });

    const list = response.data;

    return {
        title: `Featured Notes on ${site}`,
        link: `https://${site}/explore`,

View on GitHub (pinned to bed535e087)

Solutions

1. Use a :site that is in the curated allow-list (major instances like misskey.io are included) — check utils.allowSiteList for the current set.
2. If you self-host RSSHub and trust a specific instance, set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true in the environment and restart (understand this re-enables host injection for all such guarded routes).
3. If you maintain RSSHub and the instance is reputable, add it to utils.allowSiteList via PR rather than loosening the global flag.

const site = ctx.req.param('site');
const allowed = utils.allowSiteList.includes(site);
if (!allowed && !config.feature.allow_user_supply_unsafe_domain) {
    throw new ConfigNotFoundError(`'${site}' is not allowed. Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true (self-host) or use an allow-listed instance.`);
}

function isAllowedSite(site: string, allowList: string[], unsafeAllowed: boolean): boolean {
    return typeof site === 'string' && (allowList.includes(site) || unsafeAllowed);
}

When it happens

Trigger: Caller requests /misskey/featured-notes/:site where :site (e.g. 'evil.example.com') is not in the built-in allowSiteList and the operator has NOT set config.feature.allow_user_supply_unsafe_domain. The guard short-circuits before the POST to https://<site>/api/notes/featured.

Common situations: A user wants a Misskey instance that isn't on RSSHub's curated list (a small/niche or self-hosted instance); an operator who doesn't realize the env toggle exists; someone trying to abuse the route to make RSSHub fetch an internal URL.

Related errors

• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• Missing access token for Misskey API. Please set `MISSKEY_AC
• Invalid language code
• Invalid subdomain

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/557f1c5a4e344619. Report an issue: GitHub.