{"record":{"id":"47cda6c2e7282761","repo":"DIYgod/RSSHub","slug":"invalid-host","errorCode":null,"errorMessage":"Invalid host","messagePattern":"Invalid host","errorType":"validation","errorClass":"InvalidParameterError","httpStatus":503,"severity":"warning","filePath":"lib/routes/eagle/blog.ts","lineNumber":52,"sourceCode":"        supportScihub: false,\n    },\n    radar: [\n        {\n            source: ['cn.eagle.cool/blog'],\n            target: '/blog',\n        },\n    ],\n    name: 'Blog',\n    maintainers: ['Fatpandac'],\n    handler,\n    url: 'cn.eagle.cool/blog',\n};\n\nasync function handler(ctx) {\n    let cate = ctx.req.param('cate') ?? 'all';\n    let language = ctx.req.param('language') ?? 'cn';\n    if (!isValidHost(cate) || !isValidHost(language)) {\n        throw new InvalidParameterError('Invalid host');\n    }\n    if (!cateList.has(cate)) {\n        language = cate;\n        cate = 'all';\n    }\n\n    const host = `https://${language}.eagle.cool`;\n    const url = `${host}/blog/${cate === 'all' ? '' : cate}`;\n\n    const response = await got(url);\n    const $ = load(response.data);\n    const title = $('div.categories-list > div > div > div > ul > li.active').text();\n    const list = $('div.post-item')\n        .toArray()\n        .map((item): DataItem & { link: string } => ({\n            title: $(item).find('div.title').text(),\n            link: new URL($(item).find('a').attr('href')!, host).href,\n            pubDate: parseDate($(item).find('div.metas > a > span').text().replace('・', '')),","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/eagle/blog.ts#L34-L70","documentation":"Thrown as an `InvalidParameterError` when either the `cate` or `language` path parameter fails `isValidHost()`, which checks the value against the regex `/^[\\dA-Z](?:[\\dA-Z-]{0,61}[\\dA-Z])?$/i`. This rejects strings containing dots, underscores, spaces, or other characters not valid in a DNS hostname label. The check exists because the values are interpolated directly into a URL hostname: `https://${language}.eagle.cool`.","triggerScenarios":"A user passes a parameter containing characters outside the hostname-safe set — e.g., `cate` = `design.resources` (dot), `language` = `zh_cn` (underscore), or `cate` = `` (empty after trimming). The regex test fails and the error fires before any network request.","commonSituations":"User passes a URL-encoded or malformed category slug. The language parameter is omitted but the cate parameter is also omitted, and the default falls through. A malicious or accidental parameter contains path traversal characters.","solutions":["Use only hostname-safe values: alphanumeric characters and hyphens. Valid languages are `cn`, `tw`, `en`.","If omitting parameters, use the route with no path segments: `/eagle/blog`.","Check the cateList Set (`all`, `design-resources`, `learn-design`, `inside-eagle`) for valid category slugs."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import { isValidHost } from '@/utils/valid-host';\n\nfunction validateEagleParams(cate: string, language: string): void {\n    if (!isValidHost(cate) || !isValidHost(language)) {\n        throw new InvalidParameterError('Parameters must be hostname-safe (alphanumeric and hyphens only)');\n    }\n}","typeGuard":"function isValidHostSegment(value: string | undefined): boolean {\n    if (typeof value !== 'string') return false;\n    return /^[\\dA-Z](?:[\\dA-Z-]{0,61}[\\dA-Z])?$/i.test(value);\n}","tryCatchPattern":null,"preventionTips":["Pass only alphanumeric strings and hyphens as path parameters.","Use the documented category slugs: all, design-resources, learn-design, inside-eagle.","Use the documented language codes: cn, tw, en.","Avoid dots, underscores, and special characters in path parameters."],"tags":["parameter-validation","hostname-validation","ssrf-prevention","invalid-parameter-error"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}