{"record":{"id":"acea9bd9488072c3","repo":"DIYgod/RSSHub","slug":"invalid-city-acea9b","errorCode":null,"errorMessage":"Invalid city","messagePattern":"Invalid city","errorType":"validation","errorClass":"InvalidParameterError","httpStatus":503,"severity":"warning","filePath":"lib/routes/bendibao/news.ts","lineNumber":48,"sourceCode":"    maintainers: ['nczitzk'],\n    handler,\n    url: 'bendibao.com/',\n    description: `| 城市名 | 缩写 |\n| ------ | ---- |\n| 北京   | bj   |\n| 上海   | sh   |\n| 广州   | gz   |\n| 深圳   | sz   |\n\n更多城市请参见 [这里](http://www.bendibao.com/city.htm)\n\n> **香港特别行政区** 和 **澳门特别行政区** 的本地宝城市页面不更新资讯。`,\n};\n\nasync function handler(ctx) {\n    const city = ctx.req.param('city');\n    if (!isValidHost(city)) {\n        throw new InvalidParameterError('Invalid city');\n    }\n\n    const rootUrl = `http://${city}.bendibao.com`;\n\n    let response = await got({\n        method: 'get',\n        url: rootUrl,\n    });\n\n    let $ = load(response.data);\n    const title =\n        $('title')\n            .text()\n            .replace(/-爱上本地宝，生活会更好/, '') + '焦点资讯';\n\n    let items = $('ul.focus-news li')\n        .toArray()\n        .map((item): DataItem => {","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/bendibao/news.ts#L30-L66","documentation":"InvalidParameterError thrown by the bendibao news route when the :city parameter fails isValidHost, i.e. the city slug would not form a valid bendibao subdomain ({city}.bendibao.com). It guards against bogus or malicious host values before constructing the request URL.","triggerScenarios":"Calling /bendibao/news/:city with a city value that is not a valid DNS label (contains dots, slashes, is empty, or is otherwise disallowed by isValidHost).","commonSituations":"User passes a city name in Chinese characters instead of the slug (e.g. '上海' instead of 'sh'); user passes a full URL; user passes a non-existent city slug.","solutions":["Use the documented two-letter city slug (sh, gz, sz, bj, etc.) from the route description; see http://www.bendibao.com/city.htm for the full list.","Note HK and MO are intentionally unsupported because their bendibao pages do not carry news."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const city = ctx.req.param('city');\nif (!isValidHost(city)) {\n    throw new InvalidParameterError('Invalid city');\n}","typeGuard":"import { isValidHost } from '@/utils/valid-host';\nfunction isCitySlug(v: unknown): boolean {\n    return typeof v === 'string' && isValidHost(v);\n}","tryCatchPattern":null,"preventionTips":["Always pass user-supplied host segments through isValidHost to prevent SSRF.","Document the slug (not the display name) and note HK/MO are intentionally unsupported."],"tags":["bendibao","input-validation","ssrf-guard","route-parameter"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}