rsshub 1.0.0-master.fb68956 → 1.0.0-master.fbabfc2

package/lib/config.js

@@ -97,6 +97,7 @@ const calculateValue = () => {
         feature: {
             allow_user_hotlink_template: envs.ALLOW_USER_HOTLINK_TEMPLATE === 'true',
             filter_regex_engine: envs.FILTER_REGEX_ENGINE || 're2',
+            allow_user_supply_unsafe_domain: envs.ALLOW_USER_SUPPLY_UNSAFE_DOMAIN === 'true',
         },
         suffix: envs.SUFFIX,
         titleLengthLimit: parseInt(envs.TITLE_LENGTH_LIMIT) || 150,

package/lib/middleware/parameter.js

@@ -139,6 +139,13 @@ module.exports = async (ctx, next) => {
                 });
 
                 item.description = $('body').html() + '' + (config.suffix || '');
+
+                if (item._extra?.links && $('.rsshub-quote').length) {
+                    item._extra?.links?.map((e) => {
+                        e.content_html = $.html($('.rsshub-quote'));
+                        return e;
+                    });
+                }
             }
             return item;
         };
@@ -266,7 +273,7 @@ module.exports = async (ctx, next) => {
                     });
 
                     item.author = author || (parsed_result ? parsed_result.author : '');
-                    item.description = parsed_result ? entities.decodeXML(parsed_result.content) : description;
+                    item.description = parsed_result && parsed_result.content.length > 40 ? entities.decodeXML(parsed_result.content) : description;
                 });
                 await Promise.all(tasks);
             }

package/lib/middleware/template.js

@@ -1,7 +1,7 @@
-const art = require('art-template');
+const { art, json } = require('@/utils/render');
 const path = require('path');
 const config = require('@/config').value;
-const typeRegex = /\.(atom|rss|debug\.json)$/;
+const typeRegex = /\.(atom|rss|debug\.json|json)$/;
 const { collapseWhitespace, convertDateToISO8601 } = require('@/utils/common-utils');
 
 module.exports = async (ctx, next) => {
@@ -14,21 +14,25 @@ module.exports = async (ctx, next) => {
 
     await next();
 
-    if (ctx.state.type[1] === 'debug.json' && config.debugInfo) {
+    const outputType = ctx.state.type[1] || 'rss';
+
+    if (outputType === 'debug.json' && config.debugInfo) {
         ctx.set({
             'Content-Type': 'application/json; charset=UTF-8',
         });
         if (ctx.state.json) {
             ctx.body = JSON.stringify(ctx.state.json, null, 4);
         } else {
-            ctx.body = JSON.stringify({ message: 'plugin does not set json' });
+            ctx.body = JSON.stringify({ message: 'plugin does not set debug json' });
         }
     }
+    if (outputType === 'json') {
+        ctx.set({ 'Content-Type': 'application/feed+json; charset=UTF-8' });
+    }
 
     if (!ctx.body) {
         let template;
 
-        const outputType = ctx.state.type[1];
         switch (outputType) {
             case 'atom':
                 template = path.resolve(__dirname, '../views/atom.art');
@@ -60,7 +64,16 @@ module.exports = async (ctx, next) => {
                         }
                     }
 
-                    item.author = collapseWhitespace(item.author);
+                    if (typeof item.author === 'string') {
+                        item.author = collapseWhitespace(item.author);
+                    } else if (typeof item.author === 'object' && item.author !== null) {
+                        for (const a of item.author) {
+                            a.name = collapseWhitespace(a.name);
+                        }
+                        if (outputType !== 'json') {
+                            item.author = item.author.map((a) => a.name).join(', ');
+                        }
+                    }
 
                     if (item.itunes_duration && ((typeof item.itunes_duration === 'string' && item.itunes_duration.indexOf(':') === -1) || (typeof item.itunes_duration === 'number' && !isNaN(item.itunes_duration)))) {
                         item.itunes_duration = +item.itunes_duration;
@@ -68,7 +81,7 @@ module.exports = async (ctx, next) => {
                             Math.floor(item.itunes_duration / 3600) + ':' + (Math.floor((item.itunes_duration % 3600) / 60) / 100).toFixed(2).slice(-2) + ':' + (((item.itunes_duration % 3600) % 60) / 100).toFixed(2).slice(-2);
                     }
 
-                    if (outputType === 'atom') {
+                    if (outputType !== 'rss') {
                         item.pubDate = convertDateToISO8601(item.pubDate);
                         item.updated = convertDateToISO8601(item.updated);
                     }
@@ -86,10 +99,15 @@ module.exports = async (ctx, next) => {
         };
         if (config.isPackage) {
             ctx.body = data;
-        } else {
-            if (template) {
-                ctx.body = art(template, data);
-            }
+            return;
+        }
+        if (!template) {
+            return;
+        }
+        if (outputType !== 'json') {
+            ctx.body = art(template, data);
+            return;
         }
+        ctx.body = json(data);
     }
 };

package/lib/router.js

@@ -176,8 +176,8 @@ router.get('/geektime/news', lazyloadRouteHandler('./routes/geektime/news'));
 router.get('/qdaily/:type/:id', lazyloadRouteHandler('./routes/qdaily/index'));
 
 // 爱奇艺
-router.get('/iqiyi/dongman/:id', lazyloadRouteHandler('./routes/iqiyi/dongman'));
-router.get('/iqiyi/user/video/:uid', lazyloadRouteHandler('./routes/iqiyi/video'));
+// router.get('/iqiyi/dongman/:id', lazyloadRouteHandler('./routes/iqiyi/dongman'));
+// router.get('/iqiyi/user/video/:uid', lazyloadRouteHandler('./routes/iqiyi/video'));
 
 // 南方周末
 router.get('/infzm/:id', lazyloadRouteHandler('./routes/infzm/news'));
@@ -288,11 +288,11 @@ router.get('/mihoyo/bh2/:type', lazyloadRouteHandler('./routes/mihoyo/bh2'));
 // router.get('/cctv-special/:id?', lazyloadRouteHandler('./routes/cctv/special'));
 
 // 财新博客
-router.get('/caixin/blog/:column', lazyloadRouteHandler('./routes/caixin/blog'));
-router.get('/caixin/article', lazyloadRouteHandler('./routes/caixin/article'));
-router.get('/caixin/database', lazyloadRouteHandler('./routes/caixin/database'));
-router.get('/caixin/yxnews', lazyloadRouteHandler('./routes/caixin/yxnews'));
-router.get('/caixin/:column/:category', lazyloadRouteHandler('./routes/caixin/category'));
+// router.get('/caixin/blog/:column', lazyloadRouteHandler('./routes/caixin/blog'));
+// router.get('/caixin/article', lazyloadRouteHandler('./routes/caixin/article'));
+// router.get('/caixin/database', lazyloadRouteHandler('./routes/caixin/database'));
+// router.get('/caixin/yxnews', lazyloadRouteHandler('./routes/caixin/yxnews'));
+// router.get('/caixin/:column/:category', lazyloadRouteHandler('./routes/caixin/category'));
 
 // 草榴社区
 router.get('/t66y/post/:tid', lazyloadRouteHandler('./routes/t66y/post'));
@@ -330,8 +330,8 @@ router.get('/cpython/:pre?', lazyloadRouteHandler('./routes/cpython'));
 // 小米
 router.get('/mi/golden', lazyloadRouteHandler('./routes/mi/golden'));
 router.get('/mi/crowdfunding', lazyloadRouteHandler('./routes/mi/crowdfunding'));
-router.get('/mi/youpin/crowdfunding', lazyloadRouteHandler('./routes/mi/youpin/crowdfunding'));
-router.get('/mi/youpin/new/:sort?', lazyloadRouteHandler('./routes/mi/youpin/new'));
+// router.get('/mi/youpin/crowdfunding', lazyloadRouteHandler('./routes/mi/youpin/crowdfunding'));
+// router.get('/mi/youpin/new/:sort?', lazyloadRouteHandler('./routes/mi/youpin/new'));
 router.get('/miui/:device/:type?/:region?', lazyloadRouteHandler('./routes/mi/miui/index'));
 router.get('/mi/bbs/board/:boardId', lazyloadRouteHandler('./routes/mi/board'));
 
@@ -950,7 +950,7 @@ router.get('/geekpark/breakingnews', lazyloadRouteHandler('./routes/geekpark/bre
 
 // 百度
 router.get('/baidu/doodles', lazyloadRouteHandler('./routes/baidu/doodles'));
-router.get('/baidu/topwords/:boardId?', lazyloadRouteHandler('./routes/baidu/topwords'));
+// router.get('/baidu/topwords/:boardId?', lazyloadRouteHandler('./routes/baidu/topwords'));
 router.get('/baidu/daily', lazyloadRouteHandler('./routes/baidu/daily'));
 
 // 搜狗
@@ -1001,10 +1001,10 @@ router.get('/tencentvideo/playlist/:id', lazyloadRouteHandler('./routes/tencent/
 // router.get('/twmanhuagui/comic/:id/:chapterCnt?', lazyloadRouteHandler('./routes/twmanhuagui/comic'));
 
 // 拷贝漫画
-router.get('/copymanga/comic/:id/:chapterCnt?', lazyloadRouteHandler('./routes/copymanga/comic'));
+// router.get('/copymanga/comic/:id/:chapterCnt?', lazyloadRouteHandler('./routes/copymanga/comic'));
 
 // 拷贝漫画
-router.get('/copymanga/comic/:id', lazyloadRouteHandler('./routes/copymanga/comic'));
+// router.get('/copymanga/comic/:id', lazyloadRouteHandler('./routes/copymanga/comic'));
 
 // 動漫狂
 router.get('/cartoonmad/comic/:id', lazyloadRouteHandler('./routes/cartoonmad/comic'));
@@ -1023,8 +1023,8 @@ router.get('/tits-guru/category/:type', lazyloadRouteHandler('./routes/titsguru/
 router.get('/tits-guru/model/:name', lazyloadRouteHandler('./routes/titsguru/model'));
 
 // typora
-router.get('/typora/changelog', lazyloadRouteHandler('./routes/typora/changelog'));
-router.get('/typora/changelog-dev/:os?', lazyloadRouteHandler('./routes/typora/changelog-dev'));
+// router.get('/typora/changelog', lazyloadRouteHandler('./routes/typora/changelog'));
+// router.get('/typora/changelog-dev/:os?', lazyloadRouteHandler('./routes/typora/changelog-dev'));
 
 // TSSstatus
 router.get('/tssstatus/:board/:build', lazyloadRouteHandler('./routes/tssstatus'));
@@ -1286,11 +1286,11 @@ router.get('/meipai/user/:uid', lazyloadRouteHandler('./routes/meipai/user'));
 router.get('/duozhi', lazyloadRouteHandler('./routes/duozhi'));
 
 // 人人都是产品经理
-router.get('/woshipm/popular', lazyloadRouteHandler('./routes/woshipm/popular'));
-router.get('/woshipm/wen', lazyloadRouteHandler('./routes/woshipm/wen'));
-router.get('/woshipm/bookmarks/:id', lazyloadRouteHandler('./routes/woshipm/bookmarks'));
-router.get('/woshipm/user_article/:id', lazyloadRouteHandler('./routes/woshipm/user_article'));
-router.get('/woshipm/latest', lazyloadRouteHandler('./routes/woshipm/latest'));
+// router.get('/woshipm/popular', lazyloadRouteHandler('./routes/woshipm/popular'));
+// router.get('/woshipm/wen', lazyloadRouteHandler('./routes/woshipm/wen'));
+// router.get('/woshipm/bookmarks/:id', lazyloadRouteHandler('./routes/woshipm/bookmarks'));
+// router.get('/woshipm/user_article/:id', lazyloadRouteHandler('./routes/woshipm/user_article'));
+// router.get('/woshipm/latest', lazyloadRouteHandler('./routes/woshipm/latest'));
 
 // 高清电台
 router.get('/gaoqing/latest', lazyloadRouteHandler('./routes/gaoqing/latest'));
@@ -1352,7 +1352,7 @@ router.get('/ui-cn/user/:id', lazyloadRouteHandler('./routes/ui-cn/user'));
 // router.get('/dcard/:section/:type?', lazyloadRouteHandler('./routes/dcard/section'));
 
 // 北京天文馆每日一图
-router.get('/bjp/apod', lazyloadRouteHandler('./routes/bjp/apod'));
+// router.get('/bjp/apod', lazyloadRouteHandler('./routes/bjp/apod'));
 
 // 洛谷
 // router.get('/luogu/daily/:id?', lazyloadRouteHandler('./routes/luogu/daily'));
@@ -1505,8 +1505,8 @@ router.get('/bupt/news', lazyloadRouteHandler('./routes/universities/bupt/news')
 router.get('/bupt/funbox', lazyloadRouteHandler('./routes/universities/bupt/funbox'));
 
 // VOCUS 方格子
-router.get('/vocus/publication/:id', lazyloadRouteHandler('./routes/vocus/publication'));
-router.get('/vocus/user/:id', lazyloadRouteHandler('./routes/vocus/user'));
+// router.get('/vocus/publication/:id', lazyloadRouteHandler('./routes/vocus/publication'));
+// router.get('/vocus/user/:id', lazyloadRouteHandler('./routes/vocus/user'));
 
 // 一亩三分地 1point3acres
 router.get('/1point3acres/blog/:category?', lazyloadRouteHandler('./routes/1point3acres/blog'));
@@ -2033,7 +2033,7 @@ router.get('/network360/jobs', lazyloadRouteHandler('./routes/network360/jobs'))
 router.get('/zhilian/:city/:keyword', lazyloadRouteHandler('./routes/zhilian/index'));
 
 // 电鸭社区
-router.get('/eleduck/jobs', lazyloadRouteHandler('./routes/eleduck/jobs'));
+// router.get('/eleduck/jobs', lazyloadRouteHandler('./routes/eleduck/jobs'));
 
 // 北华航天工业学院 - 新闻
 router.get('/nciae/news', lazyloadRouteHandler('./routes/universities/nciae/news'));
@@ -2187,8 +2187,8 @@ router.get('/cell/cover', lazyloadRouteHandler('./routes/cell/cover'));
 // router.get('/sciencemag/early/science', lazyloadRouteHandler('./routes/sciencemag/early'));
 
 // dlsite
-router.get('/dlsite/new/:type', lazyloadRouteHandler('./routes/dlsite/new'));
-router.get('/dlsite/campaign/:type/:free?', lazyloadRouteHandler('./routes/dlsite/campaign'));
+// router.get('/dlsite/new/:type', lazyloadRouteHandler('./routes/dlsite/new'));
+// router.get('/dlsite/campaign/:type/:free?', lazyloadRouteHandler('./routes/dlsite/campaign'));
 
 // mcbbs
 router.get('/mcbbs/forum/:type', lazyloadRouteHandler('./routes/mcbbs/forum'));
@@ -2223,7 +2223,7 @@ router.get('/gov/cnca/hydt', lazyloadRouteHandler('./routes/gov/cnca/hydt'));
 router.get('/gov/cnca/zxtz', lazyloadRouteHandler('./routes/gov/cnca/zxtz'));
 
 // clickme
-router.get('/clickme/:site/:grouping/:name', lazyloadRouteHandler('./routes/clickme'));
+// router.get('/clickme/:site/:grouping/:name', lazyloadRouteHandler('./routes/clickme'));
 
 // 文汇报
 router.get('/whb/:category', lazyloadRouteHandler('./routes/whb/zhuzhan'));
@@ -2280,8 +2280,8 @@ router.get('/centbrowser/history', lazyloadRouteHandler('./routes/centbrowser/hi
 router.get('/755/user/:username', lazyloadRouteHandler('./routes/755/user'));
 
 // IKEA
-router.get('/ikea/uk/new', lazyloadRouteHandler('./routes/ikea/uk/new'));
-router.get('/ikea/uk/offer', lazyloadRouteHandler('./routes/ikea/uk/offer'));
+// router.get('/ikea/uk/new', lazyloadRouteHandler('./routes/ikea/uk/new'));
+// router.get('/ikea/uk/offer', lazyloadRouteHandler('./routes/ikea/uk/offer'));
 
 // Mastodon
 router.get('/mastodon/timeline/:site/:only_media?', lazyloadRouteHandler('./routes/mastodon/timeline_local'));
@@ -2315,7 +2315,7 @@ router.get('/chrome/webstore/extensions/:id', lazyloadRouteHandler('./routes/chr
 router.get('/rthk-news/:lang/:category', lazyloadRouteHandler('./routes/rthk-news/index'));
 
 // yahoo
-router.get('/yahoo-news/:region/:category?', lazyloadRouteHandler('./routes/yahoo-news/index'));
+// router.get('/yahoo-news/:region/:category?', lazyloadRouteHandler('./routes/yahoo-news/index'));
 
 // Yahoo!テレビ
 router.get('/yahoo-jp-tv/:query', lazyloadRouteHandler('./routes/yahoo-jp-tv/index'));
@@ -2382,7 +2382,7 @@ router.get('/ifnews/:cid', lazyloadRouteHandler('./routes/ifnews/column'));
 router.get('/scala/blog/:part?', lazyloadRouteHandler('./routes/scala-blog/scala-blog'));
 
 // Minecraft Java版游戏更新
-router.get('/minecraft/version', lazyloadRouteHandler('./routes/minecraft/version'));
+// router.get('/minecraft/version', lazyloadRouteHandler('./routes/minecraft/version'));
 
 // 微信更新日志
 router.get('/weixin/miniprogram/release', lazyloadRouteHandler('./routes/tencent/wechat/miniprogram/framework')); // 基础库更新日志
@@ -2455,7 +2455,7 @@ router.get('/cowlevel/element/:id', lazyloadRouteHandler('./routes/cowlevel/elem
 // router.get('/2048/bbs/:fid', lazyloadRouteHandler('./routes/2048/bbs'));
 
 // Google News
-router.get('/google/news/:category/:locale', lazyloadRouteHandler('./routes/google/news'));
+// router.get('/google/news/:category/:locale', lazyloadRouteHandler('./routes/google/news'));
 
 // 虛詞
 router.get('/p-articles/section/:section', lazyloadRouteHandler('./routes/p-articles/section'));
@@ -2603,8 +2603,8 @@ router.get('/weexcn/news/:typeid', lazyloadRouteHandler('./routes/weexcn/index')
 // router.get('/eastmoney/ttjj/user/:uid', lazyloadRouteHandler('./routes/eastmoney/ttjj/user'));
 
 // 紳士漫畫
-router.get('/ssmh', lazyloadRouteHandler('./routes/ssmh'));
-router.get('/ssmh/category/:cid', lazyloadRouteHandler('./routes/ssmh/category'));
+// router.get('/ssmh', lazyloadRouteHandler('./routes/ssmh'));
+// router.get('/ssmh/category/:cid', lazyloadRouteHandler('./routes/ssmh/category'));
 
 // 华南师范大学研究生学院
 router.get('/scnuyjs', lazyloadRouteHandler('./routes/universities/scnu/scnuyjs'));
@@ -3095,8 +3095,8 @@ router.get('/3k8/latest', lazyloadRouteHandler('./routes/3k8/latest'));
 // JustRun
 router.get('/justrun', lazyloadRouteHandler('./routes/justrun/index'));
 
-// 上海电力大学
-router.get('/shiep/:type', lazyloadRouteHandler('./routes/universities/shiep/index'));
+// 上海电力大学 migrated to v2
+// router.get('/shiep/:type/:id?', lazyloadRouteHandler('./routes/universities/shiep/index'));
 
 // 福建新闻
 router.get('/fjnews/:city/:limit', lazyloadRouteHandler('./routes/fjnews/fznews'));
@@ -3113,7 +3113,7 @@ router.get('/kongfz/shop/:id/:cat?', lazyloadRouteHandler('./routes/kongfz/shop'
 router.get('/xmind/mindmap/:lang?', lazyloadRouteHandler('./routes/xmind/mindmap'));
 
 // 小刀娱乐网
-router.get('/x6d/:id?', lazyloadRouteHandler('./routes/x6d/index'));
+// router.get('/x6d/:id?', lazyloadRouteHandler('./routes/x6d/index'));
 
 // 思维导图社区
 router.get('/edrawsoft/mindmap/:classId?/:order?/:sort?/:lang?/:price?/:search?', lazyloadRouteHandler('./routes/edrawsoft/mindmap'));
@@ -3179,7 +3179,7 @@ router.get('/1x/:category?', lazyloadRouteHandler('./routes/1x/index'));
 router.get('/jx3/:caty?', lazyloadRouteHandler('./routes/jx3/news'));
 
 // GQ
-router.get('/gq/tw/:caty?/:subcaty?', lazyloadRouteHandler('./routes/gq/tw/index'));
+// router.get('/gq/tw/:caty?/:subcaty?', lazyloadRouteHandler('./routes/gq/tw/index'));
 
 // 泉州市跨境电子商务协会
 router.get('/qzcea/:caty?', lazyloadRouteHandler('./routes/qzcea/index'));
@@ -3633,7 +3633,7 @@ router.get('/cppcc/:slug?', lazyloadRouteHandler('./routes/gov/cppcc/index'));
 router.get('/nace/blog/:sort?', lazyloadRouteHandler('./routes/nace/blog'));
 
 // Caixin Latest
-router.get('/caixin/latest', lazyloadRouteHandler('./routes/caixin/latest'));
+// router.get('/caixin/latest', lazyloadRouteHandler('./routes/caixin/latest'));
 
 // Semiconductor Industry Association
 router.get('/semiconductors/latest-news', lazyloadRouteHandler('./routes/semiconductors/latest-news'));
@@ -3957,7 +3957,7 @@ router.get('/partnershiponai/resources', lazyloadRouteHandler('./routes/partners
 router.get('/commonapp/blog', lazyloadRouteHandler('./routes/commonapp/blog'));
 
 // Sky Sports
-router.get('/skysports/news/:team', lazyloadRouteHandler('./routes/skysports/news'));
+// router.get('/skysports/news/:team', lazyloadRouteHandler('./routes/skysports/news'));
 
 // Europa Press
 router.get('/europapress/:category?', lazyloadRouteHandler('./routes/europapress'));

package/lib/routes/bandisoft/index.js

@@ -1,9 +1,13 @@
 const got = require('@/utils/got');
 const cheerio = require('cheerio');
+const { isValidHost } = require('@/utils/valid-host');
 
 module.exports = async (ctx) => {
     const lang = ctx.params.lang || 'en';
     const id = ctx.params.id || 'bandizip';
+    if (!isValidHost(lang)) {
+        throw Error('Invalid language code');
+    }
 
     const rootUrl = `https://${lang}.bandisoft.com`;
     const currentUrl = `${rootUrl}/${id}/history/`;

package/lib/routes/biobio/others.js

@@ -1,7 +1,12 @@
 const cheerio = require('cheerio');
 const got = require('@/utils/got');
+const { isValidHost } = require('@/utils/valid-host');
 
 module.exports = async (ctx) => {
+    if (!isValidHost(ctx.params.column)) {
+        throw Error('Invalid column');
+    }
+
     const url = `http://${ctx.params.column}.bio1000.com/${ctx.params.id}`;
     const res = await got.get(url);
     const $ = cheerio.load(res.data);

package/lib/routes/blogs/hedwig.js

@@ -4,9 +4,13 @@ const md = require('markdown-it')({
     html: true,
 });
 const dayjs = require('dayjs');
+const { isValidHost } = require('@/utils/valid-host');
 
 module.exports = async (ctx) => {
     const type = ctx.params.type;
+    if (!isValidHost(type)) {
+        throw Error('Invalid type');
+    }
 
     const url = `https://${type}.hedwig.pub`;
     const res = await got({

package/lib/routes/blogs/wordpress.js

@@ -1,7 +1,12 @@
 const parser = require('@/utils/rss-parser');
 const config = require('@/config').value;
+const allowDomain = ['lawrence.code.blog'];
 
 module.exports = async (ctx) => {
+    if (!config.feature.allow_user_supply_unsafe_domain && !allowDomain.includes(ctx.params.domain)) {
+        ctx.throw(403, `This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
+    }
+
     const scheme = ctx.params.https || 'https';
     const cdn = config.wordpress.cdnUrl;
 

package/lib/routes/booth-pm/shop.js

@@ -1,10 +1,13 @@
 const got = require('@/utils/got');
 const cheerio = require('cheerio');
-
+const { isValidHost } = require('@/utils/valid-host');
 const maxPages = 5;
 
 module.exports = async (ctx) => {
     const { subdomain } = ctx.params;
+    if (!isValidHost(subdomain)) {
+        throw Error('Invalid subdomain');
+    }
     const shopUrl = `https://${subdomain}.booth.pm`;
 
     let shopName;

package/lib/routes/craigslist/search.js

@@ -1,7 +1,12 @@
 const got = require('@/utils/got');
 const cheerio = require('cheerio');
+const { isValidHost } = require('@/utils/valid-host');
 
 module.exports = async (ctx) => {
+    if (!isValidHost(ctx.params.location)) {
+        throw Error('Invalid location');
+    }
+
     const queryParams = ctx.request.querystring;
     const queryUrl = `https://${ctx.params.location}.craigslist.org/search/${ctx.params.type}?${queryParams}`;
     const { data } = await got.get(queryUrl);

package/lib/routes/engadget/home.js

@@ -1,9 +1,13 @@
 const got = require('@/utils/got');
 const cheerio = require('cheerio');
 const parser = require('@/utils/rss-parser');
+const allowLang = ['chinese', 'cn', 'us', 'japanese', 'www'];
 
 module.exports = async (ctx) => {
     const lang = ctx.params.lang === 'us' ? 'www' : ctx.params.lang || 'cn';
+    if (!allowLang.includes(lang)) {
+        throw Error('Invalid lang');
+    }
     const rssUrl = `https://${lang}.engadget.com/rss.xml`;
     const feed = await parser.parseURL(rssUrl);
 

package/lib/routes/fanbox/main.js

@@ -4,12 +4,15 @@
 // user?: fanbox domain name
 
 const got = require('@/utils/got');
-
+const { isValidHost } = require('@/utils/valid-host');
 const conv_item = require('./conv');
 const get_header = require('./header');
 
 module.exports = async (ctx) => {
     const user = ctx.params.user || 'official'; // if no user specified, just go to official page
+    if (!isValidHost(user)) {
+        throw Error('Invalid user');
+    }
     const box_url = `https://${user}.fanbox.cc`;
 
     // get user info

package/lib/routes/fashionnetwork/headline.js

@@ -1,8 +1,12 @@
 const got = require('@/utils/got');
 const cheerio = require('cheerio');
+const { isValidHost } = require('@/utils/valid-host');
 
 module.exports = async (ctx) => {
     const country = ctx.params.country || 'ww';
+    if (!isValidHost(country)) {
+        throw Error('Invalid country');
+    }
 
     const rootUrl = `https://${country}.fashionnetwork.com`;
     const response = await got({

package/lib/routes/fashionnetwork/news.js

@@ -1,5 +1,6 @@
 const got = require('@/utils/got');
 const cheerio = require('cheerio');
+const { isValidHost } = require('@/utils/valid-host');
 
 module.exports = async (ctx) => {
     const country = ctx.params.country || 'ww';
@@ -12,6 +13,10 @@ module.exports = async (ctx) => {
     const sectorsUrl = sectors ? 'sectors%5B%5D=' + sectors.split(',').join('&sectors%5B%5D=') : '';
     const categoriesUrl = categories ? 'categs%5B%5D=' + categories.split(',').join('&categs%5B%5D=') : '';
 
+    if (!isValidHost(country)) {
+        throw Error('Invalid country');
+    }
+
     const rootUrl = `https://${country}.fashionnetwork.com`;
     const currentUrl = `${rootUrl}/news/s.jsonp?${sectorsUrl}&${categoriesUrl}`;
     const response = await got({

package/lib/routes/gitlab/common.js

@@ -0,0 +1,5 @@
+const allowHost = ['gitlab.com'];
+
+module.exports = {
+    allowHost,
+};

package/lib/routes/gitlab/explore.js

@@ -1,5 +1,7 @@
 const got = require('@/utils/got');
 const cheerio = require('cheerio');
+const config = require('@/config').value;
+const { allowHost } = require('./common');
 
 module.exports = async (ctx) => {
     let { type, host } = ctx.params;
@@ -10,6 +12,9 @@ module.exports = async (ctx) => {
         starred: 'Most stars',
         all: 'All',
     };
+    if (!config.feature.allow_user_supply_unsafe_domain && !allowHost.includes(new URL(`https://${host}/`).hostname)) {
+        ctx.throw(403, `This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
+    }
 
     const res = await got({
         method: 'get',

package/lib/routes/gitlab/release.js

@@ -1,8 +1,13 @@
 const got = require('@/utils/got');
 const { parseDate } = require('@/utils/parse-date');
+const config = require('@/config').value;
+const { allowHost } = require('./common');
 
 module.exports = async (ctx) => {
     const { namespace, project, host } = ctx.params;
+    if (!config.feature.allow_user_supply_unsafe_domain && !allowHost.includes(host)) {
+        ctx.throw(403, `This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
+    }
 
     const host_ = host ? host : 'gitlab.com';
     const namespace_ = encodeURIComponent(namespace);

package/lib/routes/gitlab/tag.js

@@ -1,8 +1,13 @@
 const got = require('@/utils/got');
 const { parseDate } = require('@/utils/parse-date');
+const config = require('@/config').value;
+const { allowHost } = require('./common');
 
 module.exports = async (ctx) => {
     const { namespace, project, host } = ctx.params;
+    if (!config.feature.allow_user_supply_unsafe_domain && !allowHost.includes(host)) {
+        ctx.throw(403, `This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
+    }
 
     const host_ = host ? host : 'gitlab.com';
     const namespace_ = encodeURIComponent(namespace);

package/lib/routes/hexo/fluid.js

@@ -1,7 +1,11 @@
 const cheerio = require('cheerio');
 const got = require('@/utils/got');
+const config = require('@/config').value;
 
 module.exports = async (ctx) => {
+    if (!config.feature.allow_user_supply_unsafe_domain) {
+        ctx.throw(403, `This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
+    }
     const url = `http://${ctx.params.url}`;
     const res = await got.get(`${url}/archives/`);
     const $ = cheerio.load(res.data);

package/lib/routes/hexo/next.js

@@ -1,7 +1,11 @@
 const cheerio = require('cheerio');
 const got = require('@/utils/got');
+const config = require('@/config').value;
 
 module.exports = async (ctx) => {
+    if (!config.feature.allow_user_supply_unsafe_domain) {
+        ctx.throw(403, `This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
+    }
     const url = `http://${ctx.params.url}`;
     const res = await got.get(`${url}/archives/`);
     const $ = cheerio.load(res.data);

package/lib/routes/hexo/yilia.js

@@ -1,7 +1,11 @@
 const cheerio = require('cheerio');
 const got = require('@/utils/got');
+const config = require('@/config').value;
 
 module.exports = async (ctx) => {
+    if (!config.feature.allow_user_supply_unsafe_domain) {
+        ctx.throw(403, `This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
+    }
     const url = `http://${ctx.params.url}`;
     const res = await got.get(url);
     const $ = cheerio.load(res.data);

package/lib/routes/mastodon/account_id.js

@@ -1,9 +1,13 @@
 const utils = require('./utils');
+const config = require('@/config').value;
 
 module.exports = async (ctx) => {
     const site = ctx.params.site;
     const account_id = ctx.params.account_id;
     const only_media = ctx.params.only_media ? 'true' : 'false';
+    if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(site)) {
+        ctx.throw(403, `This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
+    }
 
     const { account_data, data } = await utils.getAccountStatuses(site, account_id, only_media);
 

package/lib/routes/mastodon/timeline_local.js

@@ -1,9 +1,13 @@
 const got = require('@/utils/got');
 const utils = require('./utils');
+const config = require('@/config').value;
 
 module.exports = async (ctx) => {
     const site = ctx.params.site;
     const only_media = ctx.params.only_media ? 'true' : 'false';
+    if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(site)) {
+        ctx.throw(403, `This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
+    }
 
     const url = `http://${site}/api/v1/timelines/public?local=true&only_media=${only_media}`;