{"record":{"id":"d54bc69f35ffed02","repo":"DIYgod/RSSHub","slug":"this-rss-is-disabled-unless-allow-user-supply-uns-d54bc6","errorCode":null,"errorMessage":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.","messagePattern":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'\\.","errorType":"exception","errorClass":"ConfigNotFoundError","httpStatus":503,"severity":"warning","filePath":"lib/routes/91porn/utils.ts","lineNumber":8,"sourceCode":"import { config } from '@/config';\nimport ConfigNotFoundError from '@/errors/types/config-not-found';\n\nconst allowDomain = new Set(['91porn.com', 'www.91porn.com', '0122.91p30.com', 'www.91zuixindizhi.com', 'w1218.91p46.com']);\n\nconst domainValidation = (domain) => {\n    if (!config.feature.allow_user_supply_unsafe_domain && !allowDomain.has(domain)) {\n        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);\n    }\n};\n\nexport { domainValidation };\n","sourceCodeStart":1,"sourceCodeEnd":13,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/91porn/utils.ts#L1-L13","documentation":"91porn domain validation uses the same allow-list pattern as 18comic: only the hard-coded set of known mirror domains is accepted unless ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true. ConfigNotFoundError is thrown for any off-list domain to prevent SSRF and protect users from phishing mirrors.","triggerScenarios":"Calling /91porn with a domain not in {91porn.com, www.91porn.com, 0122.91p30.com, www.91zuixindizhi.com, w1218.91p46.com} while the feature flag is off.","commonSituations":"The site rotates mirror domains frequently and the user pastes the newest mirror found on a forum; allow-list is stale relative to the live site; self-hosted RSSHub with the safe default.","solutions":["Use one of the allow-listed domains verbatim.","On a self-hosted instance where you accept the risk, set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true.","Submit a PR to add the new canonical mirror to allowDomain in lib/routes/91porn/utils.ts."],"exampleFix":"# before\n/91porn/some-random-mirror.xyz/...\n# after (option A)\n/91porn/91porn.com/...\n# after (option B, self-hosted)\nALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true","handlingStrategy":"validation","validationCode":"import { config } from '@/config';\nconst ALLOW_DOMAIN_91PORN = new Set(['91porn.com','www.91porn.com','0122.91p30.com','www.91zuixindizhi.com','w1218.91p46.com']);\nfunction safe91pornDomain(domain) {\n  return ALLOW_DOMAIN_91PORN.has(domain) || config.feature.allow_user_supply_unsafe_domain === true;\n}","typeGuard":"function isAllowed91pornDomain(d, allowAny): boolean {\n  return allowAny === true || ALLOW_DOMAIN_91PORN.has(d);\n}","tryCatchPattern":null,"preventionTips":["Pin a known-good mirror in config rather than per-request URLs.","Re-evaluate allow-list currency before relying on it — these mirrors rotate often.","Understand ALLOW_USER_SUPPLY_UNSAFE_DOMAIN broadens the trust surface; only enable on self-hosted, isolated instances."],"tags":["config","security","domain-allowlist","rsshub","ssrf"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}