rsshub 1.0.0-master.ff97759 → 1.0.0-master.ffaca71

package/README.md

@@ -1,14 +1,17 @@
 <p align="center">
-<img src="https://i.loli.net/2019/04/23/5cbeb7e41414c.png" alt="RSSHub" width="100">
+<img src="https://docs.rsshub.app/img/logo.png" alt="RSSHub" width="100">
 </p>
 <h1 align="center">RSSHub</h1>
 
 > 🍰 Everything is RSSible
 
 [![telegram](https://img.shields.io/badge/chat-telegram-brightgreen.svg?logo=telegram&style=flat-square)](https://t.me/rsshub)
-[![npm publish](https://img.shields.io/github/workflow/status/DIYgod/RSSHub/publish/master?label=npm%20publish&logo=npm&style=flat-square)](https://www.npmjs.com/package/rsshub)
-[![docker publish](https://img.shields.io/github/workflow/status/DIYgod/RSSHub/%5Bdocker%5D%20CI%20for%20releases/master?label=docker%20publish&logo=docker&style=flat-square)](https://hub.docker.com/r/diygod/rsshub)
-[![test](https://img.shields.io/github/workflow/status/DIYgod/RSSHub/test/master?label=test&logo=github&style=flat-square)](https://github.com/DIYgod/RSSHub/actions/workflows/test.yml?query=event%3Apush+branch%3Amaster)
+[![npm publish](https://img.shields.io/github/actions/workflow/status/DIYgod/RSSHub/npm-publish.yml?branch=master&label=npm%20publish&logo=npm&style=flat-square)](https://www.npmjs.com/package/rsshub)
+[![docker publish](https://img.shields.io/github/actions/workflow/status/DIYgod/RSSHub/docker-release.yml?branch=master&label=docker%20publish&logo=docker&style=flat-square)](https://hub.docker.com/r/diygod/rsshub)
+[![test](https://img.shields.io/github/actions/workflow/status/DIYgod/RSSHub/test.yml?branch=master&label=test&logo=github&style=flat-square)](https://github.com/DIYgod/RSSHub/actions/workflows/test.yml?query=event%3Apush+branch%3Amaster)
+[![Test coverage](https://img.shields.io/codecov/c/github/DIYgod/RSSHub.svg?style=flat-square&logo=codecov)](https://app.codecov.io/gh/DIYgod/RSSHub/branch/master)
+[![CodeFactor](https://www.codefactor.io/repository/github/diygod/rsshub/badge)](https://www.codefactor.io/repository/github/diygod/rsshub)
+[![DeepScan grade](https://deepscan.io/api/teams/6244/projects/8135/branches/92448/badge/grade.svg)](https://deepscan.io/dashboard#view=project&tid=6244&pid=8135&bid=92448)
 
 ## Introduction
 
@@ -18,29 +21,19 @@ RSSHub delivers millions of contents aggregated from all kinds of sources, our v
 
 RSSHub can be used with browser extension [RSSHub Radar](https://github.com/DIYgod/RSSHub-Radar) and mobile auxiliary app [RSSBud](https://github.com/Cay-Zhang/RSSBud) (iOS) and [RSSAid](https://github.com/LeetaoGoooo/RSSAid) (Android)
 
-[English docs](https://docs.rsshub.app/en) | [Telegram Group](https://t.me/rsshub) | [Telegram Channel](https://t.me/awesomeRSSHub)
+[English docs](https://docs.rsshub.app) | [Telegram Group](https://t.me/rsshub) | [Telegram Channel](https://t.me/awesomeRSSHub)
 
----
-
-RSSHub 是一个开源、简单易用、易于扩展的 RSS 生成器，可以给任何奇奇怪怪的内容生成 RSS 订阅源。RSSHub 借助于开源社区的力量快速发展中，目前已适配数百家网站的上千项内容
-
-可以配合浏览器扩展 [RSSHub Radar](https://github.com/DIYgod/RSSHub-Radar) 和 移动端辅助 App [RSSBud](https://github.com/Cay-Zhang/RSSBud) (iOS) 与 [RSSAid](https://github.com/LeetaoGoooo/RSSAid) (Android) 食用
-
-[中文文档](https://docs.rsshub.app) | [Telegram 群](https://t.me/rsshub) | [Telegram 频道](https://t.me/awesomeRSSHub)
+[中文文档](https://docs.rsshub.app/zh/) | [Telegram 群](https://t.me/rsshub) | [Telegram 频道](https://t.me/awesomeRSSHub)
 
 ## Special Thanks
 
 ### Special Sponsors
 
-<div>
-<a href="https://rss3.io/" target="_blank"><img height="60px" src="https://i.imgur.com/v7TF0jp.jpg"></a>
-</div>
-
-### Sponsors
-
-[Sayori Studio](https://t.me/SayoriStudio) . [Sion Kazama](https://blog.sion.moe) . [琚致远](https://wineso.me/) . [Rolly RSS 阅读器](https://www.coolapk.com/apk/239500) . [mokeyjay](https://www.mokeyjay.com/) . [萌开源联盟](https://www.moeunion.com) . [hooke007](https://github.com/hooke007/MPV_lazy) . [feeds.pub](https://feeds.pub) . [KINGX@安全引擎](http://cve.today/)
+<p>
+<a href="https://xlog.app/" target="_blank"><img height="100px" src="https://i.imgur.com/JuhHTKD.png"></a>
+</p>
 
-[![](https://opencollective.com/static/images/become_sponsor.svg)](https://docs.rsshub.app/en/support/)
+[![](https://opencollective.com/static/images/become_sponsor.svg)](https://docs.rsshub.app/support/)
 
 ### Contributors
 
@@ -54,29 +47,24 @@ Logo designer [sheldonrrr](https://dribbble.com/sheldonrrr)
 
 ## Related Projects
 
--   [RSSHub Radar](https://github.com/DIYgod/RSSHub-Radar) | 一个可以帮助你快速发现和订阅当前网站 RSS 和 RSSHub 的浏览器扩展
--   [RSSBud](https://github.com/Cay-Zhang/RSSBud) ([TestFlight 公测](https://testflight.apple.com/join/rjCVzzHP)) | iOS 平台的 RSSHub Radar，专为移动生态优化
--   [RSSAid](https://github.com/LeetaoGoooo/RSSAid)  | 基于 Flutter 构建的 Android 平台的 RSSHub Radar
+-   [RSSHub Radar](https://github.com/DIYgod/RSSHub-Radar) | A browser extension that can help you quickly discover and subscribe to the RSS and RSSHub of current websites.
+-   [RSSBud](https://github.com/Cay-Zhang/RSSBud) ([TestFlight](https://testflight.apple.com/join/rjCVzzHP)) | RSSHub Radar for iOS platform, designed specifically for mobile ecosystem optimization.
+-   [RSSAid](https://github.com/LeetaoGoooo/RSSAid) | RSSHub Radar for Android platform built with Flutter.
+-   [DocSearch](https://github.com/Fatpandac/DocSearch) | Link RSSHub DocSearch into Raycast
 
 ## Join Us
 
 We welcome all pull requests. Suggestions and feedback are also welcomed [here](https://github.com/DIYgod/RSSHub/issues).
 
-Refer to [Join Us](https://docs.rsshub.app/en/joinus/quick-start.html)
-
-见 [参与我们](https://docs.rsshub.app/joinus/quick-start.html)
+Refer to [Join Us](https://docs.rsshub.app/joinus/quick-start)
 
 ## Deployment
 
-Refer to [Deployment](https://docs.rsshub.app/en/install/)
-
-见 [部署](https://docs.rsshub.app/install/)
+Refer to [Deployment](https://docs.rsshub.app/install/)
 
 ## Support RSSHub
 
-Refer to [Support RSSHub](https://docs.rsshub.app/en/support/)
-
-见 [支持 RSSHub](https://docs.rsshub.app/support/)
+Refer to [Support RSSHub](https://docs.rsshub.app/support/)
 
 RSSHub is open source and completely free under the MIT license. However, just like any other open source project, as the project grows, the hosting, development and maintenance requires funding support.
 
@@ -88,6 +76,7 @@ Recurring donors will be rewarded via express issue response, or even have your
 
 -   Become a Sponser on [GitHub](https://github.com/sponsors/DIYgod)
 -   Become a Sponser on [Patreon](https://www.patreon.com/DIYgod)
+-   Become a Sponser on [Open Collective](https://opencollective.com/RSSHub)
 -   Become a Sponser on [爱发电](https://afdian.net/@diygod)
 -   Contact us directly: i@diygod.me
 
@@ -95,8 +84,8 @@ Recurring donors will be rewarded via express issue response, or even have your
 
 We accept donations via the following ways:
 
--   [WeChat Pay](https://diygod.me/images/wx.jpg)
--   [Alipay](https://diygod.me/images/zfb.jpg)
+-   [WeChat Pay](https://archive.diygod.me/images/wx.jpg)
+-   [Alipay](https://archive.diygod.me/images/zfb.jpg)
 -   [Paypal](https://www.paypal.me/DIYgod)
 
 ## Author
@@ -104,4 +93,4 @@ We accept donations via the following ways:
 **RSSHub** © [DIYgod](https://github.com/DIYgod), Released under the [MIT](./LICENSE) License.<br>
 Authored and maintained by DIYgod with help from contributors ([list](https://github.com/DIYgod/RSSHub/contributors)).
 
-> Blog [@DIYgod](https://diygod.me) · GitHub [@DIYgod](https://github.com/DIYgod) · Twitter [@DIYgod](https://twitter.com/DIYgod) · Telegram Channel [@awesomeDIYgod](https://t.me/awesomeDIYgod)
+> Blog [@DIYgod](https://diygod.cc) · GitHub [@DIYgod](https://github.com/DIYgod) · Twitter [@DIYgod](https://twitter.com/DIYgod) · Telegram Channel [@awesomeDIYgod](https://t.me/awesomeDIYgod)

package/lib/api_router.js

@@ -1,11 +1,11 @@
 const Router = require('@koa/router');
 const router = new Router();
-const maintainer = require('./maintainer');
 
 router.get('/routes/:name?', (ctx) => {
     const result = {};
     let counter = 0;
 
+    const maintainer = require('./maintainer');
     Object.keys(maintainer).forEach((i) => {
         const path = i;
         const top = path.split('/')[1];

package/lib/app.js

@@ -13,6 +13,7 @@ const cache = require('./middleware/cache');
 const parameter = require('./middleware/parameter');
 const template = require('./middleware/template');
 const favicon = require('koa-favicon');
+const serve = require('koa-static');
 const debug = require('./middleware/debug');
 const accessControl = require('./middleware/access-control');
 const antiHotlink = require('./middleware/anti-hotlink');
@@ -36,7 +37,8 @@ const app = new Koa();
 app.proxy = true;
 
 // favicon
-app.use(favicon(__dirname + '/favicon.png'));
+app.use(favicon(__dirname + '/favicon.png', { maxAge: 31536000000 }));
+app.use(serve(__dirname + '/static', { maxage: 31536000000 }));
 
 // global error handing
 app.use(onerror);

package/lib/config.js

@@ -1,13 +1,16 @@
 require('dotenv').config();
-const randUserAgent = require('@/utils/rand-user-agent');
+const randUserAgent = require('./utils/rand-user-agent');
 let envs = process.env;
 let value;
+const TRUE_UA = 'RSSHub/1.0 (+http://github.com/DIYgod/RSSHub; like FeedFetcher-Google)';
 
 const calculateValue = () => {
     const bilibili_cookies = {};
     const twitter_tokens = {};
     const email_config = {};
     const discuz_cookies = {};
+    const medium_cookies = {};
+    const discourse_config = {};
 
     for (const name in envs) {
         if (name.startsWith('BILIBILI_COOKIE_')) {
@@ -22,6 +25,12 @@ const calculateValue = () => {
         } else if (name.startsWith('DISCUZ_COOKIE_')) {
             const cid = name.slice(14);
             discuz_cookies[cid] = envs[name];
+        } else if (name.startsWith('MEDIUM_COOKIE_')) {
+            const username = name.slice(14).toLowerCase();
+            medium_cookies[username] = envs[name];
+        } else if (name.startsWith('DISCOURSE_CONFIG_')) {
+            const id = name.slice('DISCOURSE_CONFIG_'.length);
+            discourse_config[id] = JSON.parse(envs[name]);
         }
     }
 
@@ -32,6 +41,7 @@ const calculateValue = () => {
         isPackage: envs.IS_PACKAGE,
         nodeName: envs.NODE_NAME,
         puppeteerWSEndpoint: envs.PUPPETEER_WS_ENDPOINT,
+        chromiumExecutablePath: envs.CHROMIUM_EXECUTABLE_PATH,
         // network
         connect: {
             port: envs.PORT || 1200, // 监听端口
@@ -40,7 +50,8 @@ const calculateValue = () => {
         listenInaddrAny: envs.LISTEN_INADDR_ANY || 1, // 是否允许公网连接，取值 0 1
         requestRetry: parseInt(envs.REQUEST_RETRY) || 2, // 请求失败重试次数
         requestTimeout: parseInt(envs.REQUEST_TIMEOUT) || 30000, // Milliseconds to wait for the server to end the response before aborting the request
-        ua: envs.UA || randUserAgent({ browser: 'chrome', os: 'mac os', device: 'desktop' }),
+        ua: envs.UA ? envs.UA : envs.NO_RANDOM_UA === 'true' || envs.NO_RANDOM_UA === '1' ? TRUE_UA : randUserAgent({ browser: 'chrome', os: 'mac os', device: 'desktop' }),
+        trueUA: TRUE_UA,
         // cors request
         allowOrigin: envs.ALLOW_ORIGIN,
         // cache
@@ -66,14 +77,16 @@ const calculateValue = () => {
             auth: envs.PROXY_AUTH,
             url_regex: envs.PROXY_URL_REGEX || '.*',
         },
+        proxyStrategy: envs.PROXY_STRATEGY || 'all', // all / on_retry
+        reverseProxyUrl: envs.REVERSE_PROXY_URL,
         // auth
         authentication: {
             name: envs.HTTP_BASIC_AUTH_NAME || 'usernam3',
             pass: envs.HTTP_BASIC_AUTH_PASS || 'passw0rd',
         },
         // access control
-        blacklist: envs.BLACKLIST && envs.BLACKLIST.split(','),
-        whitelist: envs.WHITELIST && envs.WHITELIST.split(','),
+        denylist: envs.DENYLIST && envs.DENYLIST.split(','),
+        allowlist: envs.ALLOWLIST && envs.ALLOWLIST.split(','),
         allowLocalhost: envs.ALLOW_LOCALHOST,
         accessKey: envs.ACCESS_KEY,
         // logging
@@ -81,6 +94,7 @@ const calculateValue = () => {
         debugInfo: envs.DEBUG_INFO || 'true',
         loggerLevel: envs.LOGGER_LEVEL || 'info',
         noLogfiles: envs.NO_LOGFILES,
+        showLoggerTimestamp: envs.SHOW_LOGGER_TIMESTAMP,
         sentry: {
             dsn: envs.SENTRY,
             routeTimeout: parseInt(envs.SENTRY_ROUTE_TIMEOUT) || 30000,
@@ -88,9 +102,24 @@ const calculateValue = () => {
         // feed config
         hotlink: {
             template: envs.HOTLINK_TEMPLATE,
+            includePaths: envs.HOTLINK_INCLUDE_PATHS && envs.HOTLINK_INCLUDE_PATHS.split(','),
+            excludePaths: envs.HOTLINK_EXCLUDE_PATHS && envs.HOTLINK_EXCLUDE_PATHS.split(','),
+        },
+        feature: {
+            allow_user_hotlink_template: envs.ALLOW_USER_HOTLINK_TEMPLATE === 'true',
+            filter_regex_engine: envs.FILTER_REGEX_ENGINE || 're2',
+            allow_user_supply_unsafe_domain: envs.ALLOW_USER_SUPPLY_UNSAFE_DOMAIN === 'true',
         },
         suffix: envs.SUFFIX,
         titleLengthLimit: parseInt(envs.TITLE_LENGTH_LIMIT) || 150,
+        openai: {
+            apiKey: envs.OPENAI_API_KEY,
+            model: envs.OPENAI_MODEL || 'gpt-3.5-turbo-16k',
+            temperature: envs.OPENAI_TEMPERATURE || 0.2,
+            maxTokens: envs.OPENAI_MAX_TOKENS || null,
+            endpoint: envs.OPENAI_API_ENDPOINT || 'https://api.openai.com/v1',
+            prompt: envs.OPENAI_PROMPT || 'Please summarize the following article and reply with markdown format.',
+        },
 
         // Route-specific Configurations
         bilibili: {
@@ -110,10 +139,19 @@ const calculateValue = () => {
         chuiniu: {
             member: envs.CHUINIU_MEMBER,
         },
+        civitai: {
+            cookie: envs.CIVITAI_COOKIE,
+        },
         dida365: {
             username: envs.DIDA365_USERNAME,
             password: envs.DIDA365_PASSWORD,
         },
+        discord: {
+            authorization: envs.DISCORD_AUTHORIZATION,
+        },
+        discourse: {
+            config: discourse_config,
+        },
         discuz: {
             cookies: discuz_cookies,
         },
@@ -128,6 +166,7 @@ const calculateValue = () => {
             ipb_pass_hash: envs.EH_IPB_PASS_HASH,
             sk: envs.EH_SK,
             igneous: envs.EH_IGNEOUS,
+            star: envs.EH_STAR,
             img_proxy: envs.EH_IMG_PROXY,
         },
         email: {
@@ -142,12 +181,18 @@ const calculateValue = () => {
             username: envs.FANFOU_USERNAME,
             password: envs.FANFOU_PASSWORD,
         },
+        fantia: {
+            cookies: envs.FANTIA_COOKIE,
+        },
         game4399: {
             cookie: envs.GAME_4399,
         },
         github: {
             access_token: envs.GITHUB_ACCESS_TOKEN,
         },
+        gitee: {
+            access_token: envs.GITEE_ACCESS_TOKEN,
+        },
         google: {
             fontsApiKey: envs.GOOGLE_FONTS_API_KEY,
         },
@@ -168,15 +213,27 @@ const calculateValue = () => {
             username: envs.IG_USERNAME,
             password: envs.IG_PASSWORD,
             proxy: envs.IG_PROXY,
+            cookie: envs.IG_COOKIE,
+        },
+        iwara: {
+            username: envs.IWARA_USERNAME,
+            password: envs.IWARA_PASSWORD,
         },
         lastfm: {
             api_key: envs.LASTFM_API_KEY,
         },
+        manhuagui: {
+            cookie: envs.MHGUI_COOKIE,
+        },
         mastodon: {
             apiHost: envs.MASTODON_API_HOST,
             accessToken: envs.MASTODON_API_ACCESS_TOKEN,
             acctDomain: envs.MASTODON_API_ACCT_DOMAIN,
         },
+        medium: {
+            cookies: medium_cookies,
+            articleCookie: envs.MEDIUM_ARTICLE_COOKIE || '',
+        },
         miniflux: {
             instance: envs.MINIFLUX_INSTANCE || 'https://reader.miniflux.app',
             token: envs.MINIFLUX_TOKEN || '',
@@ -195,16 +252,31 @@ const calculateValue = () => {
             username: envs.NHENTAI_USERNAME,
             password: envs.NHENTAI_PASSWORD,
         },
+        notion: {
+            key: envs.NOTION_TOKEN,
+        },
+        pianyuan: {
+            cookie: envs.PIANYUAN_COOKIE,
+        },
+        pixabay: {
+            key: envs.PIXABAY_KEY,
+        },
         pixiv: {
             refreshToken: envs.PIXIV_REFRESHTOKEN,
-            bypassCdn: envs.PIXIV_BYPASS_CDN !== '0' && envs.PIXIV_BYPASS_CDN !== 'false',
+            bypassCdn: envs.PIXIV_BYPASS_CDN && envs.PIXIV_BYPASS_CDN !== '0' && envs.PIXIV_BYPASS_CDN !== 'false',
             bypassCdnHostname: envs.PIXIV_BYPASS_HOSTNAME || 'public-api.secure.pixiv.net',
             bypassCdnDoh: envs.PIXIV_BYPASS_DOH || 'https://1.1.1.1/dns-query',
-            imgProxy: envs.PIXIV_IMG_PROXY || 'https://i.pixiv.cat',
+            imgProxy: envs.PIXIV_IMG_PROXY || 'https://i.pixiv.re',
         },
         pkubbs: {
             cookie: envs.PKUBBS_COOKIE,
         },
+        saraba1st: {
+            cookie: envs.SARABA1ST_COOKIE,
+        },
+        sehuatang: {
+            cookie: envs.SEHUATANG_COOKIE,
+        },
         scboy: {
             token: envs.SCBOY_BBS_TOKEN,
         },
@@ -219,16 +291,19 @@ const calculateValue = () => {
         telegram: {
             token: envs.TELEGRAM_TOKEN,
         },
+        tophub: {
+            cookie: envs.TOPHUB_COOKIE,
+        },
         twitter: {
             consumer_key: envs.TWITTER_CONSUMER_KEY,
             consumer_secret: envs.TWITTER_CONSUMER_SECRET,
             tokens: twitter_tokens,
-            authorization: envs.TWITTER_WEBAPI_AUTHORIZAION || 'Bearer AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA',
-            // 此处硬编码参考自https://github.com/mikf/gallery-dl/blob/master/gallery_dl/extractor/twitter.py#L550
+            authorization: envs.TWITTER_WEBAPI_AUTHORIZAION && envs.TWITTER_WEBAPI_AUTHORIZAION.split(','),
         },
         weibo: {
             app_key: envs.WEIBO_APP_KEY,
             app_secret: envs.WEIBO_APP_SECRET,
+            cookies: envs.WEIBO_COOKIES,
             redirect_url: envs.WEIBO_REDIRECT_URL,
         },
         wenku8: {
@@ -246,13 +321,16 @@ const calculateValue = () => {
         },
         youtube: {
             key: envs.YOUTUBE_KEY,
-        },
-        yuque: {
-            token: envs.YUQUE_TOKEN,
+            clientId: envs.YOUTUBE_CLIENT_ID,
+            clientSecret: envs.YOUTUBE_CLIENT_SECRET,
+            refreshToken: envs.YOUTUBE_REFRESH_TOKEN,
         },
         zhihu: {
             cookies: envs.ZHIHU_COOKIES,
         },
+        zodgame: {
+            cookie: envs.ZODGAME_COOKIE,
+        },
     };
 };
 calculateValue();

package/lib/index.js

@@ -29,7 +29,7 @@ if (config.enableCluster && cluster.isMaster && process.env.NODE_ENV !== 'test'
     }
 
     logger.info('🎉 RSSHub start! Cheers!');
-    logger.info('💖 Can you help keep this open source project alive? Please sponsor 👉 https://docs.rsshub.app/en/support');
+    logger.info('💖 Can you help keep this open source project alive? Please sponsor 👉 https://docs.rsshub.app/support');
 
     module.exports = server;
 }

package/lib/maintainer.js

@@ -1,4 +1,14 @@
 const dirname = __dirname + '/v2';
+const fs = require('fs');
+const { join } = require('path');
+
+// Presence Check
+for (const dir of fs.readdirSync(dirname)) {
+    const dirPath = join(dirname, dir);
+    if (fs.existsSync(join(dirPath, 'router.js')) && !fs.existsSync(join(dirPath, 'maintainer.js'))) {
+        throw Error(`No maintainer.js in "${dirPath}".`);
+    }
+}
 
 // 遍历整个 routes 文件夹，收集模块 maintainer.js
 const maintainerPath = require('require-all')({
@@ -11,8 +21,23 @@ const maintainers = {};
 // 将收集到的自定义模块进行合并
 for (const dir in maintainerPath) {
     const routes = maintainerPath[dir]['maintainer.js']; // Do not merge other file
+
+    // typo check e.g., ✘ module.export, ✔ module.exports
+    if (!Object.keys(routes).length) {
+        throw Error(`No maintainer in "${dir}".`);
+    }
+    for (const author of Object.values(routes)) {
+        if (!Array.isArray(author)) {
+            throw Error(`Maintainers' name should be an array in "${dir}".`);
+        }
+        // check for [], [''] or ['Someone', '']
+        if (author.length < 1 || author.includes('')) {
+            throw Error(`Empty maintainer in "${dir}".`);
+        }
+    }
+
     for (const key in routes) {
-        maintainers['/' + dir + key] = routes[key];
+        maintainers['/' + dir + (key.endsWith('/') ? key.substring(0, key.length - 1) : key)] = routes[key];
     }
 }
 
@@ -24,4 +49,9 @@ router.stack.forEach((e) => {
     }
 });
 
-module.exports = maintainers;
+module.exports = Object.keys(maintainers)
+    .sort()
+    .reduce((obj, path) => {
+        obj[path] = maintainers[path];
+        return obj;
+    }, {});

package/lib/middleware/access-control.js

@@ -15,7 +15,7 @@ module.exports = async (ctx, next) => {
     const accessKey = ctx.query.key;
     const accessCode = ctx.query.code;
 
-    const isControlled = config.accessKey || config.whitelist || config.blacklist;
+    const isControlled = config.accessKey || config.allowlist || config.denylist;
 
     const allowLocalhost = config.allowLocalhost && (await isLocalhost(ip));
 
@@ -38,14 +38,14 @@ module.exports = async (ctx, next) => {
             }
         }
 
-        if (config.whitelist) {
-            if (config.whitelist.find((white) => ip.includes(white) || requestPath.includes(white) || requestUA.includes(white))) {
+        if (config.allowlist) {
+            if (config.allowlist.find((item) => ip.includes(item) || requestPath.includes(item) || requestUA.includes(item))) {
                 return grant();
             }
         }
 
-        if (config.blacklist) {
-            if (!config.blacklist.find((black) => ip.includes(black) || requestPath.includes(black) || requestUA.includes(black))) {
+        if (config.denylist) {
+            if (!config.denylist.find((item) => ip.includes(item) || requestPath.includes(item) || requestUA.includes(item))) {
                 return grant();
             }
         }

package/lib/middleware/anti-hotlink.js

@@ -1,10 +1,40 @@
 const config = require('@/config').value;
 const cheerio = require('cheerio');
 const logger = require('@/utils/logger');
+const path = require('path');
+const { art } = require('@/utils/render');
 
-const interpolate = (str, obj) => str.replace(/\${([^}]+)}/g, (_, prop) => obj[prop]);
-// I don't want to keep another regex and
-// URL will be the standard way to parse URL
+const templateRegex = /\$\{([^{}]+)}/g;
+const allowedUrlProperties = ['hash', 'host', 'hostname', 'href', 'origin', 'password', 'pathname', 'port', 'protocol', 'search', 'searchParams', 'username'];
+const IframeWrapperTemplate = path.join(__dirname, 'templates/iframe.art');
+
+// match path or sub-path
+const matchPath = (path, paths) => {
+    for (const p of paths) {
+        if (path.startsWith(p) && (path.length === p.length || path[p.length] === '/')) {
+            return true;
+        }
+    }
+    return false;
+};
+
+// return ture if the path needs to be processed
+const filterPath = (path) => {
+    const include = config.hotlink.includePaths;
+    const exclude = config.hotlink.excludePaths;
+    return !(include && !matchPath(path, include)) && !(exclude && matchPath(path, exclude));
+};
+
+const interpolate = (str, obj) =>
+    str.replace(templateRegex, (_, prop) => {
+        let needEncode = false;
+        if (prop.endsWith('_ue')) {
+            // url encode
+            prop = prop.slice(0, -3);
+            needEncode = true;
+        }
+        return needEncode ? encodeURIComponent(obj[prop]) : obj[prop];
+    });
 const parseUrl = (str) => {
     let url;
     try {
@@ -15,40 +45,104 @@ const parseUrl = (str) => {
 
     return url;
 };
-const replaceUrls = (body, template) => {
-    const $ = cheerio.load(body, { decodeEntities: false, xmlMode: true });
-    $('img').each(function () {
-        const old_src = $(this).attr('src');
-        const url = parseUrl(old_src);
-        if (url) {
-            const new_src = interpolate(template, url);
-            $(this).attr('src', new_src);
+const replaceUrls = ($, selector, template, attribute = 'src') => {
+    $(selector).each(function () {
+        const old_src = $(this).attr(attribute);
+        if (old_src) {
+            const url = parseUrl(old_src);
+            if (url) {
+                // Cheerio will do the right thing to prohibit XSS.
+                $(this).attr(attribute, interpolate(template, url));
+            }
         }
     });
+};
+
+const wrapWithIframe = ($, selector) => {
+    $(selector).each((_, elem) => {
+        elem = $(elem);
+        elem.replaceWith(art(IframeWrapperTemplate, { content: elem.toString() }));
+    });
+};
 
-    return $.root().html();
+const process = (html, image_hotlink_template, multimedia_hotlink_template, wrap_multimedia_in_iframe) => {
+    const $ = cheerio.load(html, undefined, false);
+    if (image_hotlink_template) {
+        replaceUrls($, 'img, picture > source', image_hotlink_template);
+        replaceUrls($, 'video[poster]', image_hotlink_template, 'poster');
+    }
+    if (multimedia_hotlink_template) {
+        replaceUrls($, 'video, video > source, audio, audio > source', multimedia_hotlink_template);
+        if (!image_hotlink_template) {
+            replaceUrls($, 'video[poster]', multimedia_hotlink_template, 'poster');
+        }
+    }
+    if (wrap_multimedia_in_iframe) {
+        wrapWithIframe($, 'video, audio');
+    }
+    return $.html();
+};
+
+const validateTemplate = (template) => {
+    if (!template) {
+        return;
+    }
+    [...template.matchAll(templateRegex)].forEach((match) => {
+        const prop = match[1].endsWith('_ue') ? match[1].slice(0, -3) : match[1];
+        if (!allowedUrlProperties.includes(prop)) {
+            throw new Error(`Invalid URL property: ${prop}`);
+        }
+    });
 };
 
 module.exports = async (ctx, next) => {
     await next();
 
-    const template = config.hotlink.template;
+    let image_hotlink_template;
+    let multimedia_hotlink_template;
+    const shouldWrapInIframe = ctx.query.wrap_multimedia_in_iframe === '1';
+
+    // Read params if enabled
+    if (config.feature.allow_user_hotlink_template) {
+        // By default, the config turns these features off. Set corresponding config to
+        // true to turn this feature on.
+        // A risk is that the media URLs will be replaced by user-supplied templates,
+        // so a user could literally take the control of "where are the media from",
+        // but only in their personal-use feed URL.
+        multimedia_hotlink_template = ctx.query.multimedia_hotlink_template;
+        image_hotlink_template = ctx.query.image_hotlink_template;
+    }
+
+    // Force config hotlink template on conflict
+    if (config.hotlink.template) {
+        if (!filterPath(ctx.request.path)) {
+            image_hotlink_template = undefined;
+        } else {
+            image_hotlink_template = config.hotlink.template;
+        }
+    }
+
+    if (!image_hotlink_template && !multimedia_hotlink_template && !shouldWrapInIframe) {
+        return;
+    }
+
+    validateTemplate(image_hotlink_template);
+    validateTemplate(multimedia_hotlink_template);
+
     // Assume that only description include image link
     // and here we will only check them in description.
-    // Use Cherrio to load the description as html and filter all
+    // Use Cheerio to load the description as html and filter all
     // image link
-    if (template) {
-        if (ctx.state.data) {
-            if (ctx.state.data.description) {
-                ctx.state.data.description = replaceUrls(ctx.state.data.description, template);
-            }
-
-            ctx.state.data.item &&
-                ctx.state.data.item.forEach((item) => {
-                    if (item.description) {
-                        item.description = replaceUrls(item.description, template);
-                    }
-                });
+    if (ctx.state.data) {
+        if (ctx.state.data.description) {
+            ctx.state.data.description = process(ctx.state.data.description, image_hotlink_template, multimedia_hotlink_template, shouldWrapInIframe);
         }
+
+        ctx.state.data.item &&
+            ctx.state.data.item.forEach((item) => {
+                if (item.description) {
+                    item.description = process(item.description, image_hotlink_template, multimedia_hotlink_template, shouldWrapInIframe);
+                }
+            });
     }
 };