{"record":{"id":"c6461f66fe2beedb","repo":"DIYgod/RSSHub","slug":"invalid-domain","errorCode":null,"errorMessage":"Invalid domain","messagePattern":"Invalid domain","errorType":"validation","errorClass":"InvalidParameterError","httpStatus":null,"severity":"warning","filePath":"lib/routes/bt0/mv.ts","lineNumber":33,"sourceCode":"        supportBT: true,\n        supportPodcast: false,\n        supportScihub: false,\n    },\n    radar: [\n        {\n            source: ['2bt0.com/mv/'],\n        },\n    ],\n    name: '影视资源下载列表',\n    maintainers: ['miemieYaho'],\n    handler,\n};\n\nasync function handler(ctx) {\n    const domain = ctx.req.param('domain') ?? '2';\n    const number = ctx.req.param('number');\n    if (!/^[1-9]$/.test(domain)) {\n        throw new InvalidParameterError('Invalid domain');\n    }\n    const regex = /^\\d{6,}$/;\n    if (!regex.test(number)) {\n        throw new InvalidParameterError('Invalid number');\n    }\n\n    const host = `https://www.${domain}bt0.com`;\n    const _link = `${host}/prod/core/system/getVideoDetail/${number}`;\n\n    const data = (await doGot(0, host, _link)).data;\n    const items = Object.values<any[]>(data.ecca).flatMap((item) =>\n        item.map((i) => ({\n            title: i.zname,\n            guid: i.zname,\n            description: `${i.zname}[${i.zsize}]`,\n            link: `${host}/tr/${i.id}.html`,\n            pubDate: i.ezt,\n            enclosure_type: 'application/x-bittorrent',","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/bt0/mv.ts#L15-L51","documentation":"InvalidParameterError thrown when the `domain` path param of /bt0/mv/:domain/:number does not match /^[1-9]$/ (a single digit 1-9). The domain selects which mirror (https://www.{domain}bt0.com) to query; the regex prevents SSRF and malformed host construction.","triggerScenarios":"A request to /bt0/mv/:domain/:number where domain is not exactly one character in '1'..'9' — e.g. '2 ', '0', '12', a letter, or omitted (default '2' is valid so this only fires on an explicit bad value).","commonSituations":"Passing a two-digit mirror id; passing the full hostname instead of the single digit; URL encoding artifacts.","solutions":["Use a single digit 1-9 for the domain param, e.g. /bt0/mv/2/123456.","Omit domain to use the default '2'.","Ensure the route URL is not being constructed with extra characters."],"exampleFix":"// before\nif (!/^[1-9]$/.test(domain)) {\n    throw new InvalidParameterError('Invalid domain');\n}\n// after (state the allowed format)\nif (!/^[1-9]$/.test(domain)) {\n    throw new InvalidParameterError(`Invalid domain '${domain}': expected a single digit 1-9`);\n}","handlingStrategy":"validation","validationCode":"if (!/^[1-9]$/.test(domain)) {\n    throw new InvalidParameterError(`Invalid domain '${domain}': expected a single digit 1-9`);\n}","typeGuard":"const isBt0Domain = (d: string): boolean => /^[1-9]$/.test(d);","tryCatchPattern":null,"preventionTips":["Document that domain is a single digit 1-9, not a hostname.","Keep the allow-list regex tight to prevent SSRF via host construction."],"tags":["bt0","validation","path-parameter","ssrf-prevention","regex"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}