gchq/CyberChef · error · OperationError

Invalid input XML.

Error message

Invalid input XML.

What it means

Thrown by XPathExpression.run when xmldom's DOMParser raises a fatal error parsing the input string as application/xml. The operation installs a custom errorHandler that re-throws fatal errors; any throw is caught and re-wrapped as an OperationError with the fixed message 'Invalid input XML.' (the original parse detail is discarded).

Source

Thrown at src/core/operations/XPathExpression.mjs:61

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const [query, delimiter] = args;

        let doc;
        try {
            doc = new xmldom.DOMParser({
                errorHandler: {
                    fatalError(e) {
                        throw e;
                    }
                }
            }).parseFromString(input, "application/xml");
        } catch (err) {
            throw new OperationError("Invalid input XML.");
        }

        let nodes;
        try {
            nodes = xpath.parse(query).select({ node: doc, allowAnyNamespaceForNoPrefix: true });
        } catch (err) {
            throw new OperationError(`Invalid XPath. Details:\n${err.message}.`);
        }

        const nodeToString = function(node) {
            return node.toString();
        };

        return nodes.map(nodeToString).join(delimiter);
    }

}

View on GitHub (pinned to 4290ea7539)

Solutions

1. Verify the input is well-formed XML before the XPath step — test it in a separate XML validation step or with xmldom/DOMParser in isolation.
2. Insert a 'To Base64'/'From Base64' or decode step if the bytes are encoded; strip a leading BOM or non-XML prefix.
3. If you genuinely have HTML, convert/clean it to XHTML first, since xmldom does not tidy malformed markup.

Example fix

// before: feeding raw HTML/JSON into XPath
chef.bake("<broken><tag></broken>", [{op:"XPath Expression", args:["//tag","\n"]}]);
// after: ensure well-formed XML
chef.bake("<root><tag>x</tag></root>", [{op:"XPath Expression", args:["//tag","\n"]}]);

import { DOMParser } from "@xmldom/xmldom";
function isWellFormedXml(s) {
  try { new DOMParser({errorHandler:{fatalError:()=>{throw 0;}}}).parseFromString(s,"application/xml"); return true; } catch { return false; }
}

const looksLikeXml = (s) => typeof s === "string" && /^\s*<[^>]+>/.test(s) && /<[\w:-]+/.test(s);

try { result = chef.bake(input, recipe); } catch (e) { if (/Invalid input XML/.test(e.message)) { /* pre-clean or convert input */ } else throw e; }

When it happens

Trigger: The input to the operation is not well-formed XML: unclosed tags, stray characters before the declaration, mismatched encoding, or feeding HTML/JSON/plain text into an XPath step.

Common situations: Chaining an operation whose output is not XML (e.g. From Hex, Deflate) directly into XPath; a recipe that assumes XML but receives a truncated/partial document; BOM or non-UTF8 bytes that break the prolog.

Related errors

• Invalid XPath. Details:\n${err.message}.
• Invalid input HTML.
• Could not extract EXIF data from image: ${err}
• Unknown Frame Identifier: ${id}
• Unable to parse YAML: ${err}

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/2d7fc4701625c414. Report an issue: GitHub.