{"record":{"id":"eebd042f06e50402","repo":"DIYgod/RSSHub","slug":"this-rss-is-disabled-unless-allow-user-supply-uns-eebd04","errorCode":null,"errorMessage":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.","messagePattern":"This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'\\.","errorType":"exception","errorClass":"ConfigNotFoundError","httpStatus":null,"severity":"error","filePath":"lib/routes/domp4/utils.ts","lineNumber":94,"sourceCode":"        e = function () {\n            return String.raw`\\w+`;\n        };\n        c = 1;\n    }\n    while (c--) {\n        const replacement = k[c];\n        if (replacement) {\n            const token = e(c.toString());\n            p = p.replaceAll(new RegExp(String.raw`\\b` + token + String.raw`\\b`, 'g'), () => replacement);\n        }\n    }\n    return p;\n}\n\nfunction ensureDomain(ctx, domain = defaultDomain) {\n    const origin = `https://${domain}`;\n    if (!config.feature.allow_user_supply_unsafe_domain && !allowedDomains.has(new URL(origin).hostname)) {\n        throw new ConfigNotFoundError(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);\n    }\n    return origin;\n}\n\nexport { composeMagnetUrl, decodeCipherText, defaultDomain, ensureDomain, getUrlType, magnetTrackers };\n","sourceCodeStart":76,"sourceCodeEnd":100,"githubUrl":"https://github.com/DIYgod/RSSHub/blob/bed535e0879dc71c5aff6f1e7bd1ac21ede40115/lib/routes/domp4/utils.ts#L76-L100","documentation":"Thrown by the domp4 route's `ensureDomain` guard when the user-supplied domain is not in the hardcoded `allowedDomains` set (currently only `www.xlmp4.com`) AND the server-level feature flag `ALLOW_USER_SUPPLY_UNSAFE_DOMAIN` is not enabled. This is a security mechanism (SSRF defense) preventing users from causing the server to fetch arbitrary domains through this route. It throws ConfigNotFoundError, which signals a configuration issue rather than a bad user parameter.","triggerScenarios":"User supplies a custom domain via route path that is not www.xlmp4.com (e.g. /domp4/search/www.otherdomain.com/keyword); the site has changed its canonical domain and the allowedDomains set has not been updated; an RSSHub operator has not set the ALLOW_USER_SUPPLY_UNSAFE_DOMAIN environment variable.","commonSituations":"The domp4 site rotated to a new domain (common for piracy-adjacent sites); an operator wants to allow user-supplied domains but hasn't set the env var; a user is trying to proxy through a mirror domain.","solutions":["If running your own RSSHub instance, set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true in the environment to allow arbitrary domains (understand the SSRF risk).","If the site moved to a new permanent domain, update the allowedDomains set in lib/routes/domp4/utils.ts to include the new domain.","If using the public rsshub.app instance, only www.xlmp4.com is allowed — use the default domain or find the correct mirror.","Do not set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true on public-facing instances without additional protections."],"exampleFix":"// before\nconst allowedDomains = new Set(['www.xlmp4.com']);\n\n// after — add the new domain when the site rotates\nconst allowedDomains = new Set(['www.xlmp4.com', 'www.xlmp4.net', 'domp4.cc']);","handlingStrategy":"validation","validationCode":"// If you control the RSSHub deployment, check the feature flag\nconst isUnsafeDomainAllowed = process.env.ALLOW_USER_SUPPLY_UNSAFE_DOMAIN === 'true';\nconst allowedDomains = ['www.xlmp4.com'];\n\nfunction canUseDomain(domain: string): boolean {\n    return allowedDomains.includes(domain) || isUnsafeDomainAllowed;\n}\n\nif (!canUseDomain(requestedDomain)) {\n    console.error(`Domain '${requestedDomain}' not allowed. Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true or use ${allowedDomains.join(', ')}.`);\n}","typeGuard":"function isAllowedDomp4Domain(domain: string): boolean {\n    const allowed = new Set(['www.xlmp4.com']);\n    return allowed.has(domain);\n}","tryCatchPattern":"try {\n    const feed = await fetch(`${rsshubUrl}/domp4/search/${domain}/${keyword}`);\n} catch (e) {\n    if (e.message.includes('ALLOW_USER_SUPPLY_UNSAFE_DOMAIN')) {\n        console.error('Set ALLOW_USER_SUPPLY_UNSAFE_DOMAIN=true or use www.xlmp4.com');\n    }\n    throw e;\n}","preventionTips":["Do not enable ALLOW_USER_SUPPLY_UNSAFE_DOMAIN on public-facing instances without SSRF protections.","When the domp4 site rotates domains, update the allowedDomains set in source rather than using the unsafe flag.","Use the default domain (www.xlmp4.com) unless you have a specific reason to use another."],"tags":["domp4","config-not-found","ssrf-protection","security","feature-flag","domain-allowlist"],"backgroundTag":null,"analyzedSha":"bed535e0879dc71c5aff6f1e7bd1ac21ede40115","analyzedAt":"2026-08-12T19:29:35.364Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}