{"record":{"id":"300de082fbdf2249","repo":"DIYgod/RSSHub","slug":"this-rss-is-disabled-unless-allow-user-supply-uns-300de0","errorCode":null,"errorMessage":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.","messagePattern":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'\\.","errorType":"exception","errorClass":"ConfigNotFoundError","httpStatus":null,"severity":"error","filePath":"lib/routes/bdys/index.tsx","lineNumber":109,"sourceCode":"| ------ | ---- | ---- | ---- | ------ | ------ |\n\n#### 影视排序\n\n| 更新时间 | 豆瓣评分 |\n| -------- | -------- |\n| 0        | 1        |`,\n};\n\nasync function handler(ctx) {\n    const caty = ctx.req.param('caty') || 'all';\n    const type = ctx.req.param('type') || 'all';\n    const area = ctx.req.param('area') || 'all';\n    const year = ctx.req.param('year') || 'all';\n    const order = ctx.req.param('order') || '0';\n\n    const site = ctx.req.query('domain') || 'bdys01.com';\n    if (!config.feature.allow_user_supply_unsafe_domain && !allowDomains.has(new URL(`https://${site}`).hostname)) {\n        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);\n    }\n\n    const rootUrl = `https://www.${site}`;\n    const currentUrl = `${rootUrl}/s/${caty}?${type === 'all' ? '' : '&type=' + type}${area === 'all' ? '' : '&area=' + area}${year === 'all' ? '' : '&year=' + year}&order=${order}`;\n    const response = await got({\n        method: 'get',\n        url: currentUrl,\n    });\n\n    const $ = load(response.data);\n\n    let jsessionid = '';\n\n    const list = $('.card-body .card a')\n        .slice(0, 15)\n        .toArray()\n        .map((item): DataItem => {\n            const $item = $(item);","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/bdys/index.tsx#L91-L127","documentation":"The bdys route lets users supply a custom mirror domain via the `domain` query param. If config.feature.allow_user_supply_unsafe_domain is false AND the supplied hostname is not in the static allowDomains set, it throws ConfigNotFoundError. This is a security control: user-supplied domains can be used for SSRF, so they must be explicitly whitelisted or globally opted into.","triggerScenarios":"A request sets ?domain=some-mirror.com that is not in allowDomains, while the ALLOW_USER_SUPPLY_UNSAFE_DOMAIN feature flag is not set to true in config.","commonSituations":"bdys moved to a new mirror and the user supplies it via ?domain=; an operator has not set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN and a request tries to use a non-allowlisted domain; SSRF-hardening kicks in by default.","solutions":["Use the default domain (bdys01.com) by omitting ?domain=.","If you trust the mirror, add it to allowDomains in the route file.","Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true in config when you accept the SSRF risk and control who can call the route."],"exampleFix":"// before\nRSSHUB_CONFIG_FEATURE_ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=false\n// after\nRSSHUB_CONFIG_FEATURE_ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true","handlingStrategy":"validation","validationCode":"import config from '../../../lib/config';\nfunction isDomainAllowed(host: string, allow: Set<string>): boolean {\n  return allow.has(host) || !!config.feature.allow_user_supply_unsafe_domain;\n}\nconst host = new URL(`https://${site}`).hostname;\nif (!isDomainAllowed(host, allowDomains)) {\n  throw new ConfigNotFoundError('Domain not allowed; set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true');\n}","typeGuard":"const isAllowlistedDomain = (host: string, allow: Set<string>): boolean =>\n  allow.has(host);","tryCatchPattern":"try {\n  return await handler(ctx);\n} catch (e) {\n  if (e instanceof ConfigNotFoundError && /ALLOW_USER_SUPPLY_UNSAFE_DOMAIN/.test(e.message)) {\n    ctx.throw(403, 'Custom domain not allowed');\n  }\n  throw e;\n}","preventionTips":["Default to the built-in domain (bdys01.com) by not setting ?domain=.","Add trusted mirrors to allowDomains rather than flipping the global unsafe-domain flag.","Only enable ALLOW_USER_SUPPLY_UNSAFE_DOMAIN when the RSSHub instance is not publicly reachable, to limit SSRF exposure."],"tags":["bdys","config","security","ssrf","rss-route"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}