{"record":{"id":"557f1c5a4e344619","repo":"DIYgod/RSSHub","slug":"this-rss-is-disabled-unless-allow-user-supply-uns-557f1c","errorCode":null,"errorMessage":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.","messagePattern":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'\\.","errorType":"exception","errorClass":"ConfigNotFoundError","httpStatus":503,"severity":"warning","filePath":"lib/routes/misskey/featured-notes.ts","lineNumber":31,"sourceCode":"    example: '/misskey/notes/featured/misskey.io',\n    parameters: { site: 'instance address, domain only, without `http://` or `https://` protocol header' },\n    features: {\n        requireConfig: false,\n        requirePuppeteer: false,\n        antiCrawler: false,\n        supportBT: false,\n        supportPodcast: false,\n        supportScihub: false,\n    },\n    name: 'Featured Notes',\n    maintainers: ['Misaka13514'],\n    handler,\n};\n\nasync function handler(ctx) {\n    const site = ctx.req.param('site');\n    if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(site)) {\n        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);\n    }\n\n    // docs on: https://misskey-hub.net/docs/api/endpoints/notes/featured.html\n    const url = `https://${site}/api/notes/featured`;\n    const response = await got({\n        method: 'post',\n        url,\n        json: {\n            limit: 10,\n            offset: 0,\n        },\n    });\n\n    const list = response.data;\n\n    return {\n        title: `Featured Notes on ${site}`,\n        link: `https://${site}/explore`,","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/misskey/featured-notes.ts#L13-L49","documentation":"Thrown as ConfigNotFoundError by the Misskey 'featured notes' route. RSSHub restricts which host a user may inject via the :site parameter to a fixed allow-list (utils.allowSiteList); any host not on the list is rejected unless the operator explicitly opted in by setting ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true. This is an SSRF guard — it stops arbitrary host injection through the route.","triggerScenarios":"Caller requests /misskey/featured-notes/:site where :site (e.g. 'evil.example.com') is not in the built-in allowSiteList and the operator has NOT set config.feature.allow_user_supply_unsafe_domain. The guard short-circuits before the POST to https://<site>/api/notes/featured.","commonSituations":"A user wants a Misskey instance that isn't on RSSHub's curated list (a small/niche or self-hosted instance); an operator who doesn't realize the env toggle exists; someone trying to abuse the route to make RSSHub fetch an internal URL.","solutions":["Use a :site that is in the curated allow-list (major instances like misskey.io are included) — check utils.allowSiteList for the current set.","If you self-host RSSHub and trust a specific instance, set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true in the environment and restart (understand this re-enables host injection for all such guarded routes).","If you maintain RSSHub and the instance is reputable, add it to utils.allowSiteList via PR rather than loosening the global flag."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const site = ctx.req.param('site');\nconst allowed = utils.allowSiteList.includes(site);\nif (!allowed && !config.feature.allow_user_supply_unsafe_domain) {\n    throw new ConfigNotFoundError(`'${site}' is not allowed. Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true (self-host) or use an allow-listed instance.`);\n}","typeGuard":"function isAllowedSite(site: string, allowList: string[], unsafeAllowed: boolean): boolean {\n    return typeof site === 'string' && (allowList.includes(site) || unsafeAllowed);\n}","tryCatchPattern":null,"preventionTips":["Keep the curated allowSiteList up to date with reputable instances via PRs.","Only enable ALLOW_USER_SUPPLY_UNSAFE_DOMAIN on self-hosted instances behind a firewall.","Make the allow-list error message list the currently permitted sites so users can pick a valid one."],"tags":["ssrf-guard","allow-list","missing-config","misskey","unsafe-domain"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}