DIYgod/RSSHub · warning · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

The Sitemap transformation route fetches a user-supplied sitemap URL and converts `<urlset>` entries into RSS items. Identical SSRF gate to the html/json transform routes: requires `config.feature.allow_user_supply_unsafe_domain === true`. Throws before any HTTP call.

Source

Thrown at lib/routes/rsshub/transform/sitemap.ts:38

        requirePuppeteer: false,
        antiCrawler: false,
        supportBT: false,
        supportPodcast: false,
        supportScihub: false,
    },
    name: 'Transformation - Sitemap',
    maintainers: ['flrngel'],
    description: `Specify options (in the format of query string) in parameter \`routeParams\` parameter to extract data from Sitemap. (Follows Sitemap Protocol 0.9)

| Key     | Meaning              | Accepted Values | Default                          |
| ------- | -------------------- | --------------- | -------------------------------- |
| \`title\` | The title of the RSS | \`string\`        | The first \`<loc>\` in the sitemap |`,
    handler,
};

async function handler(ctx) {
    if (!config.feature.allow_user_supply_unsafe_domain) {
        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }
    const url = ctx.req.param('url');
    const response = await got({
        method: 'get',
        url,
    });

    const routeParams = new URLSearchParams(ctx.req.param('routeParams'));
    const $ = load(response.data, { xmlMode: true });

    const rssTitle = routeParams.get('title') || ($('urlset url').length && $('urlset url').first().find('loc').text() ? $('urlset url').first().find('loc').text() : 'Sitemap');

    const urls = $('urlset url').toArray();
    const items =
        urls && urls.length
            ? (urls
                  .map((item) => {
                      try {

View on GitHub (pinned to bed535e087)

Solutions

Set `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true` on an instance you control, with appropriate network egress controls, and restart.
Use a purpose-built sitemap-to-RSS tool outside RSSHub if you cannot safely enable the flag.
Point users at native routes when the target site has one.

Example fix

// before
# flag unset

// after
ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true

Defensive patterns

Strategy: validation

Validate before calling

if (!config.feature?.allow_user_supply_unsafe_domain) {
    return ctx.body('Transform sitemap route requires ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true.', 403);
}

Type guard

const isUnsafeDomainAllowed = (c: typeof config): boolean =>
    c.feature?.allow_user_supply_unsafe_domain === true;

Prevention

Pair the flag with firewall egress rules.
Run transform routes on a separate instance from authenticated routes.
Rotate which instances are publicly reachable.

When it happens

Trigger: A request to /rsshub/transform/sitemap/... on an instance with the flag disabled.

Common situations: Public rsshub.app usage; fresh self-hosted deploy; operator removed the flag after a security review.

Related errors

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/a5d0e18061893439. Report an issue: GitHub.