{"record":{"id":"6e35ca97a7da4774","repo":"DIYgod/RSSHub","slug":"invalid-site-6e35ca","errorCode":null,"errorMessage":"Invalid site","messagePattern":"Invalid site","errorType":"validation","errorClass":"InvalidParameterError","httpStatus":400,"severity":"warning","filePath":"lib/routes/people/index.ts","lineNumber":28,"sourceCode":"import { isValidHost } from '@/utils/valid-host';\n\nexport const route: Route = {\n    path: '/:site?/:category{.+}?',\n    name: '首页头条',\n    maintainers: ['nczitzk', 'pseudoyu'],\n    example: '/people',\n    handler,\n};\n\nasync function handler(ctx) {\n    const { site = 'www' } = ctx.req.param();\n    const { category: requestedCategory = site === 'www' ? '59476' : '' } = ctx.req.param();\n    const category = site === 'cpc' && requestedCategory === '24h' ? '64093/64387' : requestedCategory;\n\n    const limit = ctx.req.query('limit') ? Number(ctx.req.query('limit')) : 30;\n\n    if (!isValidHost(site)) {\n        throw new InvalidParameterError('Invalid site');\n    }\n    const rootUrl = `http://${site}.people.com.cn`;\n    const path = site === 'politics' && !category ? 'GB/1024' : site === 'society' && category === '1008' ? '' : category ? `GB/${category}` : '';\n    const requestedUrl = new URL(path, rootUrl).href;\n    const { $, url: currentUrl } = await fetchChannel(requestedUrl);\n    const articleRootUrl = new URL('/', currentUrl).href;\n\n    $('em').remove();\n    $('.bshare-more, .page_n, .page').remove();\n\n    $('a img, h3 img').each((_, e) => {\n        $(e).parent().remove();\n    });\n\n    let items = $('.p6, div.p2j_list, div.headingNews, div.ej_list_box, .leftItem, div.p2j_con02 > div.fl, div.jsnew_line')\n        .find('a')\n        .slice(0, limit)\n        .toArray()","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/people/index.ts#L10-L46","documentation":"Thrown as an `InvalidParameterError` when the `site` path parameter fails the `isValidHost()` validation. The site value is used to construct the root URL `http://${site}.people.com.cn`. The `isValidHost` utility checks whether the site string is a syntactically valid hostname component, preventing SSRF and malformed URLs.","triggerScenarios":"Requesting `/people/<site>/...` with a site value that is not a valid hostname label — containing special characters, dots, spaces, or other invalid characters. Examples: `site='evil.com'`, `site='a.b'`, `site='../'`.","commonSituations":"User passes a malformed site value. An attacker attempts path traversal or SSRF via the site parameter. User misunderstands the parameter as a full URL rather than a subdomain label.","solutions":["Use a valid People's Daily subdomain label like 'www', 'cpc', 'politics', 'society' (just the subdomain prefix, not a full URL).","Omit the site parameter entirely to default to 'www'.","Check the `isValidHost` utility in `@/utils/valid-host` for exact validation rules."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate site before constructing the URL\nimport { isValidHost } from '@/utils/valid-host';\nif (!isValidHost(site)) {\n    throw new InvalidParameterError(`Invalid site '${site}'. Use a valid subdomain label like 'www', 'cpc', 'politics'.`);\n}","typeGuard":"function isValidPeopleSite(site: string): boolean {\n    return isValidHost(site);\n}","tryCatchPattern":null,"preventionTips":["Pass only the subdomain label (e.g., 'www', 'cpc'), not a full URL.","Omit the site parameter to default to 'www'.","Understand isValidHost checks hostname label validity, not whether the subdomain exists."],"tags":["validation","people","invalid-parameter","ssrf-guard","chinese-site"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}