{"record":{"id":"c797464b30758b35","repo":"DIYgod/RSSHub","slug":"this-rss-is-disabled-unless-allow-user-supply-uns-c79746","errorCode":null,"errorMessage":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.","messagePattern":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'\\.","errorType":"exception","errorClass":"ConfigNotFoundError","httpStatus":null,"severity":"warning","filePath":"lib/routes/mastodon/account-id.ts","lineNumber":43,"sourceCode":"    features: {\n        requireConfig: false,\n        requirePuppeteer: false,\n        antiCrawler: false,\n        supportBT: false,\n        supportPodcast: false,\n        supportScihub: false,\n    },\n    name: 'User timeline (by account ID)',\n    maintainers: ['notofoe', 'pseudoyu'],\n    handler,\n};\n\nasync function handler(ctx) {\n    const site = ctx.req.param('site');\n    const account_id = ctx.req.param('account_id');\n    const only_media = ctx.req.param('only_media') === 'true' ? 'true' : 'false';\n    if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(site)) {\n        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);\n    }\n\n    const { account_data, data } = await utils.getAccountStatuses(site, account_id, only_media);\n\n    return {\n        title: `${account_data.display_name} (@${account_data.acct})`,\n        link: account_data.url,\n        description: account_data.note,\n        item: utils.parseStatuses(data),\n        allowEmpty: true,\n    };\n}\n","sourceCodeStart":25,"sourceCodeEnd":56,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/mastodon/account-id.ts#L25-L56","documentation":"ConfigNotFoundError thrown by the Mastodon account-id route when the requested instance (site path param) is not in the built-in allowSiteList (mastodon.social, pawoo.net, fosstodon.org, or the configured MASTODON_API_HOST) and config.feature.allow_user_supply_unsafe_domain is false. This is an SSRF guard: RSSHub refuses to fetch arbitrary user-supplied hostnames unless explicitly opted in.","triggerScenarios":"GET /mastodon/account-id/:site/:account_id/:only_media? where :site is e.g. 'mastodon.online' (not in the allowlist) and ALLOW_USER_SUPPLY_UNSAFE_DOMAIN is unset/false.","commonSituations":"User wants to follow an account on an instance that is not on the curated allowlist; operator deploying a public RSSHub and unwilling to allow arbitrary domains; misconfiguration where they set the env var under a slightly different name.","solutions":["Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true in the RSSHub environment (only for trusted/private deployments, since it disables the SSRF guard).","Set MASTODON_API_HOST to your instance (e.g. mastodon.online) so it is added to allowSiteList.","Use the acct-based route with a preconfigured instance rather than supplying a raw site in the URL.","If you run a public instance, do NOT enable this and instead request the maintainers allowlist the instance."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const ALLOWED = ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean);\nif (!ALLOWED.includes(site) && !config.feature.allow_user_supply_unsafe_domain) {\n    throw new ConfigNotFoundError('Instance not allowlisted; set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true or MASTODON_API_HOST');\n}","typeGuard":"const isAllowlistedSite = (site: string): boolean =>\n    ['mastodon.social','pawoo.net','fosstodon.org', config.mastodon.apiHost].filter(Boolean).includes(site);","tryCatchPattern":null,"preventionTips":["Pre-validate the site segment against the allowlist before doing network I/O.","Only enable ALLOW_USER_SUPPLY_UNSAFE_DOMAIN on private deployments.","Prefer the acct-based route with MASTODON_API_HOST for repeat subscriptions."],"tags":["mastodon","config","ssrf","config-not-found","security"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}