{"record":{"id":"cac9352862c44e2c","repo":"DIYgod/RSSHub","slug":"invalid-domain-cac935","errorCode":null,"errorMessage":"Invalid domain","messagePattern":"Invalid domain","errorType":"validation","errorClass":"InvalidParameterError","httpStatus":null,"severity":"warning","filePath":"lib/routes/bt0/tlist.ts","lineNumber":42,"sourceCode":"        supportBT: true,\n        supportPodcast: false,\n        supportScihub: false,\n    },\n    radar: [\n        {\n            source: ['2bt0.com/tlist/'],\n        },\n    ],\n    name: '最新资源列表',\n    maintainers: ['miemieYaho'],\n    handler,\n};\n\nasync function handler(ctx) {\n    const domain = ctx.req.param('domain') ?? '2';\n    const sc = ctx.req.param('sc');\n    if (!/^[1-9]$/.test(domain)) {\n        throw new InvalidParameterError('Invalid domain');\n    }\n    if (!/^[1-5]$/.test(sc)) {\n        throw new InvalidParameterError('Invalid sc');\n    }\n\n    const host = `https://www.${domain}bt0.com`;\n    const _link = `${host}/prod/core/system/getTList?sc=${sc}`;\n\n    const data = await doGot(0, host, _link);\n    const items = data.data.list.map((item) => ({\n        title: item.zname,\n        guid: item.zname,\n        description: `《${item.title}》  导演: ${item.daoyan}<br>编剧: ${item.bianji}<br>演员: ${item.yanyuan}<br>简介: ${item.conta.trim()}`,\n        link: host + item.aurl,\n        pubDate: item.eztime.endsWith('前') ? parseRelativeDate(item.eztime) : item.eztime,\n        enclosure_type: 'application/x-bittorrent',\n        enclosure_url: item.zlink,\n        enclosure_length: genSize(item.zsize),","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/bt0/tlist.ts#L24-L60","documentation":"InvalidParameterError thrown when the `domain` path param of /bt0/tlist/:domain/:sc does not match /^[1-9]$/. Identical guard to bt0/mv: the single digit selects the mirror host www.{domain}bt0.com and prevents SSRF/host injection.","triggerScenarios":"A request to /bt0/tlist/:domain/:sc with a domain value outside '1'..'9' (two digits, '0', letters, etc.). The default '2' is valid, so this only fires on an explicitly bad supplied value.","commonSituations":"Passing the full hostname; passing a multi-digit mirror id; URL encoding issues.","solutions":["Use a single digit 1-9 for domain, e.g. /bt0/tlist/2/1.","Omit domain to default to '2'.","Verify the route URL has no stray characters in the domain segment."],"exampleFix":"// before\nif (!/^[1-9]$/.test(domain)) {\n    throw new InvalidParameterError('Invalid domain');\n}\n// after\nif (!/^[1-9]$/.test(domain)) {\n    throw new InvalidParameterError(`Invalid domain '${domain}': expected a single digit 1-9`);\n}","handlingStrategy":"validation","validationCode":"if (!/^[1-9]$/.test(domain)) {\n    throw new InvalidParameterError(`Invalid domain '${domain}': expected a single digit 1-9`);\n}","typeGuard":"const isBt0Domain = (d: string): boolean => /^[1-9]$/.test(d);","tryCatchPattern":null,"preventionTips":["Document that domain is a single digit 1-9.","Keep the tight regex to prevent SSRF."],"tags":["bt0","validation","path-parameter","ssrf-prevention","regex"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}