gchq/CyberChef · error · OperationError

Invalid input HTML.

Error message

Invalid input HTML.

What it means

CSSSelector parses the input with xmldom's DOMParser before querying with nwmatcher. If the parser throws (malformed XML/HTML that xmldom cannot turn into a document), the catch block rethrows as 'Invalid input HTML.'. Note xmldom is XML-oriented, so many real-world HTML strings can trip it.

Source

Thrown at src/core/operations/CSSSelector.mjs:61

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const [query, delimiter] = args,
            parser = new xmldom.DOMParser();
        let dom,
            result;

        if (!query.length || !input.length) {
            return "";
        }

        try {
            dom = parser.parseFromString(input);
        } catch (err) {
            throw new OperationError("Invalid input HTML.");
        }

        try {
            const matcher = nwmatcher({document: dom});
            result = matcher.select(query, dom);
        } catch (err) {
            throw new OperationError("Invalid CSS Selector. Details:\n" + err.message);
        }

        const nodeToString = function(node) {
            return node.toString();
            /* xmldom does not return the outerHTML value.
            switch (node.nodeType) {
                case node.ELEMENT_NODE: return node.outerHTML;
                case node.ATTRIBUTE_NODE: return node.value;
                case node.TEXT_NODE: return node.wholeText;
                case node.COMMENT_NODE: return node.data;
                case node.DOCUMENT_NODE: return node.outerHTML;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Pre-clean or tidy the HTML/XML before passing it (e.g. close tags, fix entities).
2. If the input is real HTML, consider an HTML-tolerant parser in a prior step.
3. Catch the OperationError and report the parse failure to the user instead of crashing the recipe.

Example fix

// before
input = '<div><p>hello</div>'
// after
input = '<div><p>hello</p></div>'

try { cssSelector.run(input, args); }
catch (e) { if (/Invalid input HTML/.test(e.message)) { /* tidy/repair HTML then retry */ } else throw e; }

When it happens

Trigger: Calling CSSSelector.run with input that the xmldom DOMParser.parseFromString rejects - e.g. unclosed tags, invalid entity references, encoding issues, or content xmldom's strict parser cannot tolerate.

Common situations: Feeding messy real-world HTML (unclosed <br>, <img>, entity errors, BOM, non-UTF bytes); expecting browser-grade HTML tolerance from an XML parser; passing JSON or plain text.

Related errors

• Invalid CSS Selector. Details: ${err.message}
• Invalid recipe
• Invalid marker while parsing JPEG at pos ${stream.position}:
• Unable to parse JPEG successfully
• Invalid block type while parsing DEFLATE stream at pos ${str

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/96ef4f6955419aff. Report an issue: GitHub.