{"record":{"id":"2869f6c25ee2e836","repo":"DIYgod/RSSHub","slug":"rss-for-this-domain-is-disabled-unless-allow-user","errorCode":null,"errorMessage":"RSS for this domain is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true' or 'MASTODON_API_HOST' is set.","messagePattern":"RSS for this domain is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true' or 'MASTODON_API_HOST' is set\\.","errorType":"exception","errorClass":"ConfigNotFoundError","httpStatus":null,"severity":"warning","filePath":"lib/routes/mastodon/utils.ts","lineNumber":100,"sourceCode":"        });\n        account_data = account_response.data;\n    }\n\n    return { account_data, data };\n}\n\nasync function getAccountIdByAcct(acct) {\n    const mastodonConfig = config.mastodon;\n\n    // acctHost is from the acct param of the request, and acctDomain is from either acctHost or the config\n    const acctHost = acct.split('@').filter(Boolean)[1];\n    const site = mastodonConfig.apiHost || acctHost;\n    const acctDomain = mastodonConfig.acctDomain || acctHost;\n    if (!(site && acctDomain)) {\n        throw new ConfigNotFoundError('Mastodon RSS is disabled due to the lack of <a href=\"https://docs.rsshub.app/deploy/config#route-specific-configurations\">relevant config</a>');\n    }\n    if (!config.feature.allow_user_supply_unsafe_domain && !allowSiteList.includes(site)) {\n        throw new ConfigNotFoundError(`RSS for this domain is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true' or 'MASTODON_API_HOST' is set.`);\n    }\n\n    const search_url = `https://${site}/api/v2/search`;\n    const cacheUid = `mastodon_acct_id/${site}/${acct}`;\n\n    const account_id = await cache.tryGet(cacheUid, async () => {\n        const search_response = await got({\n            method: 'get',\n            url: search_url,\n            headers: apiHeaders(site),\n            searchParams: {\n                q: acct,\n                type: 'accounts',\n            },\n        });\n        const [acctUser, acctHost] = acct.split('@').filter(Boolean);\n        let acctOnServer;\n","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/mastodon/utils.ts#L82-L118","documentation":"ConfigNotFoundError thrown inside getAccountIdByAcct when the resolved site is not in allowSiteList and config.feature.allow_user_supply_unsafe_domain is false. This is the same SSRF guard as the site-param Mastodon routes, applied to the acct-based lookup so a user cannot point the search at an arbitrary host.","triggerScenarios":"acct 'user@some-random.instance' resolves site to 'some-random.instance', which is not mastodon.social/pawoo.net/fosstodon.org/MASTODON_API_HOST, and ALLOW_USER_SUPPLY_UNSAFE_DOMAIN is false.","commonSituations":"Following a remote account whose instance is not allowlisted; public RSSHub with the SSRF guard on; user supplied the wrong instance segment.","solutions":["Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true on trusted/private deployments.","Set MASTODON_API_HOST to the instance you want to allow (adds it to allowSiteList).","Double-check the instance segment of the acct is correct and reachable.","On public deployments, keep the guard and request an allowlist addition."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const ALLOWED = ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean);\nif (!ALLOWED.includes(site) && !config.feature.allow_user_supply_unsafe_domain) {\n    throw new ConfigNotFoundError('Instance not allowlisted; set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true or MASTODON_API_HOST');\n}","typeGuard":"const isAllowlistedSite = (site: string): boolean =>\n    ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean).includes(site);","tryCatchPattern":null,"preventionTips":["Validate the resolved site against the allowlist before the search call.","Use MASTODON_API_HOST for instances you subscribe to.","Keep the SSRF guard enabled on public deployments."],"tags":["mastodon","config","ssrf","config-not-found","security"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}