DIYgod/RSSHub · warning · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

91porn domain validation uses the same allow-list pattern as 18comic: only the hard-coded set of known mirror domains is accepted unless ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true. ConfigNotFoundError is thrown for any off-list domain to prevent SSRF and protect users from phishing mirrors.

Source

Thrown at lib/routes/91porn/utils.ts:8

import { config } from '@/config';
import ConfigNotFoundError from '@/errors/types/config-not-found';

const allowDomain = new Set(['91porn.com', 'www.91porn.com', '0122.91p30.com', 'www.91zuixindizhi.com', 'w1218.91p46.com']);

const domainValidation = (domain) => {
    if (!config.feature.allow_user_supply_unsafe_domain && !allowDomain.has(domain)) {
        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }
};

export { domainValidation };

View on GitHub (pinned to bed535e087)

Solutions

Use one of the allow-listed domains verbatim.
On a self-hosted instance where you accept the risk, set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true.
Submit a PR to add the new canonical mirror to allowDomain in lib/routes/91porn/utils.ts.

Example fix

# before
/91porn/some-random-mirror.xyz/...
# after (option A)
/91porn/91porn.com/...
# after (option B, self-hosted)
ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true

Defensive patterns

Strategy: validation

Validate before calling

import { config } from '@/config';
const ALLOW_DOMAIN_91PORN = new Set(['91porn.com','www.91porn.com','0122.91p30.com','www.91zuixindizhi.com','w1218.91p46.com']);
function safe91pornDomain(domain) {
  return ALLOW_DOMAIN_91PORN.has(domain) || config.feature.allow_user_supply_unsafe_domain === true;
}

Type guard

function isAllowed91pornDomain(d, allowAny): boolean {
  return allowAny === true || ALLOW_DOMAIN_91PORN.has(d);
}

Prevention

Pin a known-good mirror in config rather than per-request URLs.
Re-evaluate allow-list currency before relying on it — these mirrors rotate often.
Understand ALLOW_USER_SUPPLY_UNSAFE_DOMAIN broadens the trust surface; only enable on self-hosted, isolated instances.

When it happens

Trigger: Calling /91porn with a domain not in {91porn.com, www.91porn.com, 0122.91p30.com, www.91zuixindizhi.com, w1218.91p46.com} while the feature flag is off.

Common situations: The site rotates mirror domains frequently and the user pastes the newest mirror found on a forum; allow-list is stale relative to the live site; self-hosted RSSHub with the safe default.

Related errors

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/d54bc69f35ffed02. Report an issue: GitHub.