DIYgod/RSSHub · warning · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

The JSON transformation route mirrors the HTML one: it fetches an arbitrary user-supplied URL and reshapes the JSON into RSS. The same SSRF gate (`config.feature.allow_user_supply_unsafe_domain`) blocks the handler unless the operator has opted in. The check runs before `got({url})` and before routeParams parsing.

Source

Thrown at lib/routes/rsshub/transform/json.ts:76

| Parameter     | Value                                                                    |
| ------------- | ------------------------------------------------------------------------ |
| \`url\`         | \`https://api.github.com/repos/ginuerzh/gost/releases\`                    |
| \`routeParams\` | \`title=Gost releases&itemTitle=tag_name&itemLink=html_url&itemDesc=body\` |

Parsing of \`routeParams\` parameter:

| Parameter   | Value           |
| ----------- | --------------- |
| \`title\`     | \`Gost releases\` |
| \`itemTitle\` | \`tag_name\`      |
| \`itemLink\`  | \`html_url\`      |
| \`itemDesc\`  | \`body\`          |`,
};

async function handler(ctx) {
    if (!config.feature.allow_user_supply_unsafe_domain) {
        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }
    const url = ctx.req.param('url');
    const response = await got({
        method: 'get',
        url,
    });

    const routeParams = new URLSearchParams(ctx.req.param('routeParams'));
    let rssTitle = routeParams.get('title');
    if (!rssTitle) {
        const resp = await got({
            method: 'get',
            url: new URL(url).origin,
        });
        const $ = load(resp.data);
        rssTitle = $('title').text();
    }

View on GitHub (pinned to bed535e087)

Solutions

Enable `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true` on your own instance and restart, understanding this opens an SSRF vector — pair it with network policy.
Run a dedicated, firewalled RSSHub just for transform routes if you need them regularly.
Check whether a native route exists for the target API and use it instead.

Example fix

// before
# config.feature.allow_user_supply_unsafe_domain = false (default)

// after
ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true

Defensive patterns

Strategy: validation

Validate before calling

if (!config.feature?.allow_user_supply_unsafe_domain) {
    return ctx.body('Transform JSON route requires ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true.', 403);
}

Type guard

const isUnsafeDomainAllowed = (c: typeof config): boolean =>
    c.feature?.allow_user_supply_unsafe_domain === true;

Prevention

Enable the flag only on a network-isolated instance.
Prefer route-specific feeds when available.
Audit user-supplied URLs with an allowlist before enabling broadly.

When it happens

Trigger: A request to /rsshub/transform/json/... on an instance where `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN` is not enabled.

Common situations: User tries the transform feature on a public RSSHub instance; self-hosted instance was deployed from default docker-compose without the env var.

Related errors

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/e29456069478280c. Report an issue: GitHub.