DIYgod/RSSHub · error · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

A ConfigNotFoundError (not a generic Error) thrown because the wordpress route lets the caller supply an arbitrary URL — an SSRF risk. RSSHub refuses to run it unless the operator explicitly opts in by setting ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true. RSSHub maps ConfigNotFoundError to an HTTP error that tells the user the feed is misconfigured rather than broken.

Source

Thrown at lib/routes/wordpress/index.ts:17

import { load } from 'cheerio';

import { config } from '@/config';
import ConfigNotFoundError from '@/errors/types/config-not-found';
import type { Data, Route } from '@/types';
import got from '@/utils/got';
import { parseDate } from '@/utils/parse-date';
import parser from '@/utils/rss-parser';

import { apiSlug, bakeFilterSearchParams, bakeFiltersWithPair, bakeUrl, fetchData, getFilterParamsForUrl, parseFilterStr } from './util';

async function handler(ctx) {
    const { url = 'https://wordpress.org/news', filter } = ctx.req.param();
    const limit = ctx.req.query('limit') ? Number(ctx.req.query('limit')) : 50;

    if (!config.feature.allow_user_supply_unsafe_domain) {
        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }

    if (!/^https?:\/\/[^\s#$./?].\S*$/i.test(url)) {
        throw new Error('Invalid URL');
    }

    const cdn = config.wordpress.cdnUrl;
    const rootUrl = url;

    const filters = parseFilterStr(filter);
    const filtersWithPair = await bakeFiltersWithPair(filters, rootUrl);

    const searchParams = bakeFilterSearchParams(filters, 'name', false);
    const apiSearchParams = bakeFilterSearchParams(filtersWithPair, 'id', true);

    apiSearchParams.append('_embed', 'true');
    apiSearchParams.append('per_page', String(limit));

View on GitHub (pinned to bed535e087)

Solutions

Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true in the RSSHub environment and restart, understanding the SSRF implications.
If you do not control the instance, ask the operator to enable it or run your own.
For wordpress.org/news specifically, use a route that does not require the flag if available.

Example fix

# before (env)
# (flag absent)
# after
ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true

Defensive patterns

Strategy: validation

Validate before calling

// Check the feature flag up-front in your deployment script
if (process.env.ALLOW_USER_SUPPLY_UNSAFE_DOMAIN !== 'true') {
    console.warn('wordpress route disabled — set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true to enable (SSRF risk)');
}

Type guard

function isWordpressDisabledError(e: unknown): boolean {
    return e instanceof Error && e.name === 'ConfigNotFoundError' && /ALLOW_USER_SUPPLY_UNSAFE_DOMAIN/i.test(e.message);
}

Try / catch

try {
    return await wordpressHandler(ctx);
} catch (e) {
    if (isWordpressDisabledError(e)) {
        return ctx.json({ error: 'Route disabled by admin. Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true.' }, 501);
    }
    throw e;
}

Prevention

Treat ALLOW_USER_SUPPLY_UNSAFE_DOMAIN as a security decision — document the SSRF exposure before enabling.
When enabling, also restrict outbound egress at the network layer to limit SSRF blast radius.
Prefer type-specific RSSHub routes over the generic wordpress route when available.

When it happens

Trigger: Any call to /wordpress/... while config.feature.allow_user_supply_unsafe_domain is falsy (the default), regardless of the url argument.

Common situations: Self-hosted RSSHub where the operator wants to follow arbitrary wordpress blogs but has not enabled the flag; trying the public rsshub.app instance (which does not enable it) with a custom URL.

Related errors

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/9c09601a7f34d9c7. Report an issue: GitHub.