{"record":{"id":"b87807849517e19a","repo":"DIYgod/RSSHub","slug":"this-rss-is-disabled-unless-allow-user-supply-uns-b87807","errorCode":null,"errorMessage":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.","messagePattern":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'\\.","errorType":"exception","errorClass":"ConfigNotFoundError","httpStatus":null,"severity":"error","filePath":"lib/routes/biquge/index.ts","lineNumber":67,"sourceCode":"\n路由默认返回最新 **1** 个章节，如有需要一次性获取多个章节，可在路由后指定 \\`limit\\` 参数。如上面的例子：订阅 [《大主宰》](http://www.biqu5200.net/0_7/) 并获取最新的 **10** 个章节。此时，路由为 [\\`/biquge/http://www.biqu5200.net/0_7/?limit=10\\`](https://rsshub.app/biquge/http://www.biqu5200.net/0_7/?limit=10)\n\n需要注意的是，单次获取的所有章节更新时间统一设定为最新章节的更新时间。也就是说，获取最新的 **10** 个章节时，除了最新 **1** 个章节的更新时间是准确的（和网站一致的），其他 **9** 个章节的更新时间是不准确的。\n\n另外，若设置获取章节数目过多，可能会触发网站反爬，导致路由不可用。\n:::\n\n::: warning\n上方列举的网址可能部分不可用，这取决于该网站的维护者是否持续运营网站。请选择可以正常访问的网址，获取更新的前提是该网站可以正常访问。\n:::`,\n    handler,\n};\n\nasync function handler(ctx) {\n    const currentUrl = ctx.req.param('url');\n    const rootUrl = currentUrl.split('/').slice(0, 3).join('/');\n    if (!config.feature.allow_user_supply_unsafe_domain && !allowHost.has(new URL(rootUrl).hostname)) {\n        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);\n    }\n\n    const response = await got(currentUrl, {\n        responseType: 'buffer',\n    });\n\n    const isGBK = /charset=\"?'?gb/i.test(response.data.toString());\n    const encoding = isGBK ? 'gbk' : 'utf-8';\n\n    const $ = load(iconv.decode(response.data, encoding));\n    const author = $('meta[property=\"og:novel:author\"]').attr('content');\n    const pubDate = timezone(parseDate($('meta[property=\"og:novel:update_time\"]').attr('content')!), 8);\n\n    let items = $('dl dd a')\n        .toArray()\n        .toReversed()\n        .slice(0, ctx.req.query('limit') ? Number.parseInt(ctx.req.query('limit')) : 1)\n        .map((item): DataItem => {","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/biquge/index.ts#L49-L85","documentation":"ConfigNotFoundError thrown by the biquge handler as a safety gate. The route accepts a user-supplied URL (lib/routes/biquge), which is an SSRF/unsafe-domain risk; the handler only allows hosts in the allowHost set unless the operator explicitly opts in via feature.allow_user_supply_unsafe_domain. This converts an unsafe request into a clear configuration instruction.","triggerScenarios":"A request to /biquge/:url where the hostname extracted from the supplied URL is not in the allowHost allowlist, AND config.feature.allow_user_supply_unsafe_domain is not true.","commonSituations":"Operator points the route at a biquge mirror not in the built-in allowlist; deploying a newer RSSHub where the allowlist changed; intentionally wanting to track a private/new novel site.","solutions":["If you trust the domain, set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true in the environment and restart RSSHub.","Otherwise use one of the hostnames already in the allowHost set (documented in the route description).","To permanently add a trusted mirror, extend the allowHost set in the source and redeploy."],"exampleFix":"# before: ALLOW_USER_supply_unsafe_domain unset -> error for non-allowlist host\n# after\nexport ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true","handlingStrategy":"validation","validationCode":"const hostname = new URL(rootUrl).hostname;\nif (!config.feature.allow_user_supply_unsafe_domain && !allowHost.has(hostname)) {\n    throw new ConfigNotFoundError(`Host ${hostname} not allowed; set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true`);\n}","typeGuard":"const isAllowedHost = (hostname: string): boolean =>\n    config.feature.allow_user_supply_unsafe_domain || allowHost.has(hostname);","tryCatchPattern":null,"preventionTips":["Only enable ALLOW_USER_SUPPLY_UNSAFE_DOMAIN on trusted, isolated deployments.","Keep the allowHost set curated; prefer extending it over enabling the global flag.","Validate the supplied URL parses and is http/https before the allowlist check."],"tags":["biquge","security","ssrf","config","allowlist"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}