{"record":{"id":"628f71c289044ac3","repo":"fish2018/pansou","slug":"s-628f71","errorCode":null,"errorMessage":"[%s] 请求来源不被允许","messagePattern":"\\[(.+?)\\] 请求来源不被允许","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugin/huban/huban.go","lineNumber":162,"sourceCode":"\t\t}\n\n\t\t// 检查referer是否在允许列表中\n\t\tallowed := false\n\t\tfor _, allowedReferer := range AllowedReferers {\n\t\t\tif strings.HasPrefix(referer, allowedReferer) {\n\t\t\t\tif DebugLog {\n\t\t\t\t\tfmt.Printf(\"[%s] 允许来自 %s 的请求\\n\", p.Name(), referer)\n\t\t\t\t}\n\t\t\t\tallowed = true\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\n\t\tif !allowed {\n\t\t\tif DebugLog {\n\t\t\t\tfmt.Printf(\"[%s] 拒绝来自 %s 的请求\\n\", p.Name(), referer)\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"[%s] 请求来源不被允许\", p.Name())\n\t\t}\n\t}\n\n\tresult, err := p.SearchWithResult(keyword, ext)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn result.Results, nil\n}\n\n// SearchWithResult 带结果统计的搜索接口\nfunc (p *HubanAsyncPlugin) SearchWithResult(keyword string, ext map[string]interface{}) (model.PluginSearchResult, error) {\n\treturn p.AsyncSearchWithResult(keyword, p.searchImpl, p.MainCacheKey, ext)\n}\n\n// searchImpl 搜索实现 - HTML解析版本\nfunc (p *HubanAsyncPlugin) searchImpl(client *http.Client, keyword string, ext map[string]interface{}) ([]model.SearchResult, error) {\n\t// 性能统计","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/fish2018/pansou/blob/beaa56133755a548ebc51b090b3816e2ae044aa6/plugin/huban/huban.go#L144-L180","documentation":"The huban plugin's Search checks the caller-supplied referer against an allow-list (anti-hotlink protection); if the referer is not allowed, it refuses to perform the search. This mirrors the site's own Referer check — requests that look like they don't come from permitted origins are rejected.","triggerScenarios":"Calling p.Search(keyword, ext) (SearchWithResult path) with a referer header that fails the plugin's allowed-referer test; the plugin logs '拒绝来自 %s 的请求' when DebugLog is enabled and returns this error.","commonSituations":"Frontend/proxy forwarding a user's actual Referer through to the plugin; missing or wrong referer configuration; embedding the plugin behind a different domain than the allow-list expects.","solutions":["Set the caller's Referer header to one of the plugin's allowed origins (see the allowed list near the check in huban.go).","Run with DebugLog enabled to see which referer string was rejected and why.","Update the allow-list configuration to include your legitimate origin.","If referer checking is unwanted in your deployment, disable/bypass the check explicitly rather than sending arbitrary referers."],"exampleFix":"// before\nreq.Header.Set(\"Referer\", req.Host) // rejected by allow-list\nresult, err := p.Search(keyword, ext)\n// after\nreq.Header.Set(\"Referer\", \"https://your-allowed-origin.example/\")\nresult, err := p.Search(keyword, ext)","handlingStrategy":"validation","validationCode":"req.Header.Set(\"Referer\", \"https://allowed-origin.example/\")\nif !isRefererAllowed(req.Header.Get(\"Referer\")) {\n    return errors.New(\"referer not in huban allow-list\")\n}","typeGuard":"func isRefererAllowed(referer string) bool {\n    for _, a := range allowedReferers {\n        if strings.HasPrefix(referer, a) {\n            return true\n        }\n    }\n    return false\n}","tryCatchPattern":"results, err := p.Search(keyword, ext)\nif err != nil {\n    if strings.Contains(err.Error(), \"请求来源不被允许\") {\n        return errors.New(\"configure an allowed Referer before calling huban search\")\n    }\n    return err\n}","preventionTips":["Always set a Referer matching one of the plugin's allowed origins","Strip/rewrite user-supplied Referer at your proxy before it reaches the plugin","Enable DebugLog once during setup to confirm the accepted referer value","Document the allow-list in your deployment config so it is updated with origin changes"],"tags":["referer","access-control","http","anti-hotlink"],"backgroundTag":"permission-denied","analyzedSha":"beaa56133755a548ebc51b090b3816e2ae044aa6","analyzedAt":"2026-09-07T00:31:18.025Z","contentChangedAt":"2026-09-07T00:31:18.025Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}