DIYgod/RSSHub · warning · ConfigNotFoundError

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN

Error message

This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.

What it means

Thrown as ConfigNotFoundError by the Misskey user-timeline route — the same SSRF allow-list guard as the other Misskey routes. After the acct regex validates pureUsername and site, the host portion (site) must be in utils.allowSiteList unless ALLOW_USER_SUPPLY_UNSAFE_DOMAIN is enabled.

Source

Thrown at lib/routes/misskey/user-timeline.ts:52

        requirePuppeteer: false,
        antiCrawler: false,
        supportBT: false,
        supportPodcast: false,
        supportScihub: false,
    },
    name: 'User timeline',
    maintainers: ['siygle', 'SnowAgar25', 'HanaokaYuzu'],
    handler,
};

async function handler(ctx): Promise<Data> {
    const username = ctx.req.param('username');
    const [, pureUsername, site] = username.match(/@?(\w+)@(\w+\.\w+)/) || [];
    if (!pureUsername || !site) {
        throw new InvalidParameterError('Provide a valid Misskey username');
    }
    if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(site)) {
        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
    }

    const routeParams = querystring.parse(ctx.req.param('routeParams'));
    const withRenotes = fallback(undefined, queryToBoolean(routeParams.withRenotes), false);
    const mediaOnly = fallback(undefined, queryToBoolean(routeParams.mediaOnly), false);
    const simplifyAuthor = fallback(undefined, queryToBoolean(routeParams.simplifyAuthor), false);

    // Check for conflicting parameters
    if (withRenotes && mediaOnly) {
        throw new InvalidParameterError('withRenotes and mediaOnly cannot both be true.');
    }

    const { accountData, avatarUrl } = await utils.getUserTimelineByUsername(pureUsername, site, {
        withRenotes,
        mediaOnly,
    });

    return {

View on GitHub (pinned to bed535e087)

Solutions

Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true on a self-hosted RSSHub (recognize the SSRF implications) and restart.
Or target a user on an allow-listed instance.
Or contribute the instance to utils.allowSiteList if reputable.

Defensive patterns

Strategy: validation

Validate before calling

if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(site)) {
    throw new ConfigNotFoundError(`Host '${site}' not in allow-list. Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true (self-host) or use an allowed instance.`);
}

Type guard

function isAllowedSite(site: string, allowList: string[], unsafeAllowed: boolean): boolean {
    return typeof site === 'string' && (allowList.includes(site) || unsafeAllowed);
}

Prevention

Validate the host portion of the acct against the allow-list before deeper processing.
Prefer adding reputable instances to allowSiteList over the global unsafe flag.
Combine the acct-parse and allow-list checks into one helper shared by all misskey routes.

When it happens

Trigger: The username acct is syntactically valid (matched the regex) but the extracted site is not on the curated allow-list and the unsafe-domain flag is off. The handler refuses to call https://<site>/api/users/show etc.

Common situations: User follows someone on a niche/self-hosted Misskey instance not in RSSHub's list; the operator hasn't enabled the unsafe-domain toggle.

Related errors

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/f23e4dd9ad4e5685. Report an issue: GitHub.