Language: TypeScript
Label: safe
CWE: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Code:
module.exports = async (ctx) => {
    const type = ctx.params.type ?? 'www';
    if (!isValidHost(type)) {
        throw Error('Invalid type');
    }

    const base_url = `https://${type}.solidot.org`;
    const response = await got({
        method: 'get',
        url: base_url,
    });
    const data = response.data; // content is html format
    const $ = cheerio.load(data);

    // get urls
    const a = $('div.block_m').find('div.bg_htit > h2 > a');
    const urls = [];
    for (let i = 0; i < a.length; ++i) {
        urls.push($(a[i]).attr('href'));
    }

    // get articles
    const msg_list = await Promise.all(urls.map((u) => ctx.cache.tryGet(u, () => get_article(u))));

    // feed the data
    ctx.state.data = {
        title: '奇客的资讯，重要的东西',
        link: base_url,
        item: msg_list,
    };
};