{"record":{"id":"3030b063569e01c9","repo":"DIYgod/RSSHub","slug":"invalid-language-code","errorCode":null,"errorMessage":"Invalid language code","messagePattern":"Invalid language code","errorType":"exception","errorClass":null,"httpStatus":503,"severity":"warning","filePath":"lib/routes-deprecated/bandisoft/index.js","lineNumber":9,"sourceCode":"const got = require('@/utils/got');\nconst cheerio = require('cheerio');\nconst { isValidHost } = require('@/utils/valid-host');\n\nmodule.exports = async (ctx) => {\n    const lang = ctx.params.lang || 'en';\n    const id = ctx.params.id || 'bandizip';\n    if (!isValidHost(lang)) {\n        throw new Error('Invalid language code');\n    }\n\n    const rootUrl = `https://${lang}.bandisoft.com`;\n    const currentUrl = `${rootUrl}/${id}/history/`;\n    const response = await got({\n        method: 'get',\n        url: currentUrl,\n    });\n\n    const $ = cheerio.load(response.data);\n\n    const items = $('h2')\n        .map((_, item) => {\n            item = $(item);\n\n            const title = item.text();\n            item.children('font').remove();\n","sourceCodeStart":1,"sourceCodeEnd":27,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes-deprecated/bandisoft/index.js#L1-L27","documentation":"Thrown by the bandisoft route when the `lang` path parameter (default 'en') fails isValidHost. isValidHost rejects values that are not valid DNS-label-safe (no dots, no slashes, no protocol, ASCII-only, etc.), preventing injection into the constructed URL `https://${lang}.bandisoft.com`.","triggerScenarios":"User requests /bandisoft/<lang>/... with a lang containing dots, slashes, protocol characters, or otherwise invalid host characters.","commonSituations":"Typo such as 'en-US' (contains a dash is usually fine but a dot/slash is not); attempting path traversal; passing a full URL fragment.","solutions":["Use a plain subdomain label supported by bandisoft (e.g. 'en', 'zh', 'ja', 'ko').","Omit the lang segment to fall back to the default 'en'.","Avoid embedding dots, slashes, or protocols in the path parameter."],"exampleFix":"// before\n/bandisoft/en-US/bandizip\n// after\n/bandisoft/en/bandizip","handlingStrategy":"validation","validationCode":"import { isValidHost } from '@/utils/valid-host';\nconst lang = params.lang ?? 'en';\nif (!isValidHost(lang)) throw new Error('Invalid language code');","typeGuard":"const isSafeLang = (v: unknown): boolean =>\n  typeof v === 'string' && /^[a-z0-9-]+$/i.test(v) && !v.includes('.');","tryCatchPattern":null,"preventionTips":["Pass only single DNS-label subdomains.","Reject user input containing '.', '/', ':', or protocol schemes before building URLs."],"tags":["validation","routes","ssrf-guard"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}