DIYgod/RSSHub · warning · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

The generic HTML transformation route /<transform>/html lets a user feed an arbitrary URL into RSSHub and extract elements from the response. Because that is an SSRF surface, the route is disabled unless the RSSHub operator has explicitly opted in by setting `config.feature.allow_user_supply_unsafe_domain` to true. The check runs at the very top of the handler, before the user-supplied URL is fetched.

Source

Thrown at lib/routes/rsshub/transform/html.ts:63

| \`itemPubDateAttr\` | The attributes of \`pubDate\` element as pubDate                                                          | \`string\`        | Element html           |
| \`itemContent\`     | The HTML elements as \`description\` in \`item\` using CSS selector ( in \`itemLink\` page for full content ) | \`string\`        |                        |
| \`encoding\`        | The encoding of the HTML content                                                                        | \`string\`        | utf-8                  |

Parameters parsing in the above example:

| Parameter     | Value                                     |
| ------------- | ----------------------------------------- |
| \`url\`         | \`https://wechat2rss.xlab.app/posts/list/\` |
| \`routeParams\` | \`item=div[class='post-content'] p a\`      |

Parsing of \`routeParams\` parameter:

| Parameter | Value                           |
| --------- | ------------------------------- |
| \`item\`    | \`div[class='post-content'] p a\` |`,
    handler: async (ctx) => {
        if (!config.feature.allow_user_supply_unsafe_domain) {
            throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
        }
        const url = ctx.req.param('url');
        const response = await got({
            method: 'get',
            url,
            responseType: 'arrayBuffer',
        });

        const routeParams = new URLSearchParams(ctx.req.param('routeParams'));
        const encoding = routeParams.get('encoding') || 'utf-8';
        const decoder = new TextDecoder(encoding);

        const $ = load(decoder.decode(response.data));
        const rssTitle = routeParams.get('title') || $('title').text();
        const item = routeParams.get('item') || 'html';
        let items: DataItem[] = $(item)
            .toArray()
            .slice(0, 20)

View on GitHub (pinned to bed535e087)

Solutions

1. If you operate the instance and accept the SSRF risk, set `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true` in the RSSHub environment and restart. Restrict network egress at the firewall layer as defense-in-depth.
2. If you do not control the instance, run your own RSSHub with the flag enabled rather than asking the public instance to enable it.
3. Prefer route-specific feeds when one exists for the target site — they are not gated by this flag.

Example fix

// before
# .env — flag unset

// after
# .env
ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true

if (!config.feature?.allow_user_supply_unsafe_domain) {
    return ctx.body('Transform route requires ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true.', 403);
}

const isUnsafeDomainAllowed = (c: typeof config): boolean =>
    c.feature?.allow_user_supply_unsafe_domain === true;

When it happens

Trigger: Any request to /rsshub/transform/html/... on an instance where `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN` is not `true`. The throw fires before `got({url})`, so no outbound request is attempted.

Common situations: Default RSSHub deploy (the flag defaults to false); a user discovers the transform route in the docs and tries it on rsshub.app, which leaves the feature off for security.

Related errors

• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• Invalid language code
• Invalid subdomain
• Invalid country

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/7710bccec1cd608a. Report an issue: GitHub.