{"record":{"id":"96ef4f6955419aff","repo":"gchq/CyberChef","slug":"invalid-input-html","errorCode":null,"errorMessage":"Invalid input HTML.","messagePattern":"Invalid input HTML\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/CSSSelector.mjs","lineNumber":61,"sourceCode":"    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const [query, delimiter] = args,\n            parser = new xmldom.DOMParser();\n        let dom,\n            result;\n\n        if (!query.length || !input.length) {\n            return \"\";\n        }\n\n        try {\n            dom = parser.parseFromString(input);\n        } catch (err) {\n            throw new OperationError(\"Invalid input HTML.\");\n        }\n\n        try {\n            const matcher = nwmatcher({document: dom});\n            result = matcher.select(query, dom);\n        } catch (err) {\n            throw new OperationError(\"Invalid CSS Selector. Details:\\n\" + err.message);\n        }\n\n        const nodeToString = function(node) {\n            return node.toString();\n            /* xmldom does not return the outerHTML value.\n            switch (node.nodeType) {\n                case node.ELEMENT_NODE: return node.outerHTML;\n                case node.ATTRIBUTE_NODE: return node.value;\n                case node.TEXT_NODE: return node.wholeText;\n                case node.COMMENT_NODE: return node.data;\n                case node.DOCUMENT_NODE: return node.outerHTML;","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/CSSSelector.mjs#L43-L79","documentation":"CSSSelector parses the input with xmldom's DOMParser before querying with nwmatcher. If the parser throws (malformed XML/HTML that xmldom cannot turn into a document), the catch block rethrows as 'Invalid input HTML.'. Note xmldom is XML-oriented, so many real-world HTML strings can trip it.","triggerScenarios":"Calling CSSSelector.run with input that the xmldom DOMParser.parseFromString rejects - e.g. unclosed tags, invalid entity references, encoding issues, or content xmldom's strict parser cannot tolerate.","commonSituations":"Feeding messy real-world HTML (unclosed <br>, <img>, entity errors, BOM, non-UTF bytes); expecting browser-grade HTML tolerance from an XML parser; passing JSON or plain text.","solutions":["Pre-clean or tidy the HTML/XML before passing it (e.g. close tags, fix entities).","If the input is real HTML, consider an HTML-tolerant parser in a prior step.","Catch the OperationError and report the parse failure to the user instead of crashing the recipe."],"exampleFix":"// before\ninput = '<div><p>hello</div>'\n// after\ninput = '<div><p>hello</p></div>'","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { cssSelector.run(input, args); }\ncatch (e) { if (/Invalid input HTML/.test(e.message)) { /* tidy/repair HTML then retry */ } else throw e; }","preventionTips":["Tidy or repair HTML/XML before parsing.","Remember xmldom is XML-strict; real-world HTML often needs pre-processing.","Validate well-formedness at the input boundary."],"tags":["html","css","xmldom","parsing","selector"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}