DIYgod/RSSHub · error · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

Thrown by the domp4 route's `ensureDomain` guard when the user-supplied domain is not in the hardcoded `allowedDomains` set (currently only `www.xlmp4.com`) AND the server-level feature flag `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN` is not enabled. This is a security mechanism (SSRF defense) preventing users from causing the server to fetch arbitrary domains through this route. It throws ConfigNotFoundError, which signals a configuration issue rather than a bad user parameter.

Source

Thrown at lib/routes/domp4/utils.ts:94

        e = function () {
            return String.raw`\w+`;
        };
        c = 1;
    }
    while (c--) {
        const replacement = k[c];
        if (replacement) {
            const token = e(c.toString());
            p = p.replaceAll(new RegExp(String.raw`\b` + token + String.raw`\b`, 'g'), () => replacement);
        }
    }
    return p;
}

function ensureDomain(ctx, domain = defaultDomain) {
    const origin = `https://${domain}`;
    if (!config.feature.allow_user_supply_unsafe_domain && !allowedDomains.has(new URL(origin).hostname)) {
        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }
    return origin;
}

export { composeMagnetUrl, decodeCipherText, defaultDomain, ensureDomain, getUrlType, magnetTrackers };

View on GitHub (pinned to bed535e087)

Solutions

1. If running your own RSSHub instance, set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true in the environment to allow arbitrary domains (understand the SSRF risk).
2. If the site moved to a new permanent domain, update the allowedDomains set in lib/routes/domp4/utils.ts to include the new domain.
3. If using the public rsshub.app instance, only www.xlmp4.com is allowed — use the default domain or find the correct mirror.
4. Do not set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true on public-facing instances without additional protections.

Example fix

// before
const allowedDomains = new Set(['www.xlmp4.com']);

// after — add the new domain when the site rotates
const allowedDomains = new Set(['www.xlmp4.com', 'www.xlmp4.net', 'domp4.cc']);

// If you control the RSSHub deployment, check the feature flag
const isUnsafeDomainAllowed = process.env.ALLOW_USER_SUPPLY_UNSAFE_DOMAIN === 'true';
const allowedDomains = ['www.xlmp4.com'];

function canUseDomain(domain: string): boolean {
    return allowedDomains.includes(domain) || isUnsafeDomainAllowed;
}

if (!canUseDomain(requestedDomain)) {
    console.error(`Domain '${requestedDomain}' not allowed. Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true or use ${allowedDomains.join(', ')}.`);
}

function isAllowedDomp4Domain(domain: string): boolean {
    const allowed = new Set(['www.xlmp4.com']);
    return allowed.has(domain);
}

try {
    const feed = await fetch(`${rsshubUrl}/domp4/search/${domain}/${keyword}`);
} catch (e) {
    if (e.message.includes('ALLOW_USER_SUPPLY_UNSAFE_DOMAIN')) {
        console.error('Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true or use www.xlmp4.com');
    }
    throw e;
}

When it happens

Trigger: User supplies a custom domain via route path that is not www.xlmp4.com (e.g. /domp4/search/www.otherdomain.com/keyword); the site has changed its canonical domain and the allowedDomains set has not been updated; an RSSHub operator has not set the ALLOW_USER_SUPPLY_UNSAFE_DOMAIN environment variable.

Common situations: The domp4 site rotated to a new domain (common for piracy-adjacent sites); an operator wants to allow user-supplied domains but hasn't set the env var; a user is trying to proxy through a mirror domain.

Related errors

• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN
• This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/eebd042f06e50402. Report an issue: GitHub.