{"record":{"id":"630e4596fc4c23b2","repo":"DIYgod/RSSHub","slug":"invalid-section-name","errorCode":null,"errorMessage":"Invalid section name","messagePattern":"Invalid section name","errorType":"validation","errorClass":"InvalidParameterError","httpStatus":503,"severity":"error","filePath":"lib/routes/slashdot/index.ts","lineNumber":52,"sourceCode":"        {\n            source: ['science.slashdot.org'],\n            target: '/science',\n        },\n        {\n            source: ['yro.slashdot.org'],\n            target: '/yro',\n        },\n    ],\n    name: 'News',\n    maintainers: ['TonyRL'],\n    handler,\n};\n\nasync function handler(ctx) {\n    const { section } = ctx.req.param();\n\n    if (section && !isValidHost(section)) {\n        throw new InvalidParameterError('Invalid section name');\n    }\n\n    const link = section ? `https://${section}.slashdot.org` : 'https://slashdot.org';\n    const response = await ofetch(link);\n    const $ = load(response);\n\n    const list = $('.article')\n        .toArray()\n        .map((item) => {\n            const $item = $(item);\n            const a = $item.find('.story-title a').first();\n            const details = $item.find('.details');\n\n            return {\n                title: a.text(),\n                link: a.attr('href'),\n                description: $item.find('.body').html(),\n                pubDate: parseDate(","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/slashdot/index.ts#L34-L70","documentation":"Thrown as an InvalidParameterError when the optional `section` path parameter on the Slashdot route is present but fails the isValidHost() check. isValidHost validates the string against a DNS-label regex (/^[\\dA-Z](?:[\\dA-Z-]{0,61}[\\dA-Z])?$/i) ensuring it is a syntactically valid subdomain label. This prevents the handler from constructing a URL like https://<malicious>.slashdot.org or https://<invalid>.slashdot.org that could cause request errors or SSRF.","triggerScenarios":"A GET to /slashdot/<section> where section contains characters not allowed in DNS labels: underscores, dots, spaces, special characters, or is an empty-looking encoded value. For example /slashdot/tech_news or /slashdot/foo.bar would fail the regex.","commonSituations":"User types a section name with an underscore or period (Slashdot sections are single DNS labels like 'devices', 'science', 'yro'); URL encoding produces unexpected characters; or a bot/scanner probes with arbitrary path segments.","solutions":["Use a valid Slashdot section subdomain: devices, build, entertainment, technology, science, yro, or omit the section entirely for the main page.","Ensure the section contains only alphanumeric characters and hyphens, starts and ends with alphanumeric, and is 1-63 characters.","If no specific section is needed, request /slashdot with no path parameter."],"exampleFix":"// before\nGET /slashdot/tech_news\n\n// after\nGET /slashdot/technology","handlingStrategy":"validation","validationCode":"const VALID_SECTIONS = ['devices', 'build', 'entertainment', 'technology', 'science', 'yro'];\nconst { section } = ctx.req.param();\nif (section && !VALID_SECTIONS.includes(section)) {\n    throw new InvalidParameterError(`Invalid section. Valid sections: ${VALID_SECTIONS.join(', ')}`);\n}","typeGuard":"function isValidSlashdotSection(s: string | undefined): boolean {\n    if (!s) return true; // empty is valid (main page)\n    return isValidHost(s);\n}","tryCatchPattern":null,"preventionTips":["Prefer an explicit allowlist of valid sections over the generic isValidHost regex, since only specific subdomains actually exist.","Include valid section names in the error message so users can self-correct.","Document the available sections in the route parameters description."],"tags":["validation","user-input","dns","ssrf-prevention","slashdot"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}