gchq/CyberChef · error · OperationError

Invalid XPath. Details:\n${err.message}.

Error message

Invalid XPath. Details:\n${err.message}.

What it means

Thrown by XPathExpression.run when xpath.parse(query).select(...) raises an exception while evaluating the user-supplied XPath expression against the already-parsed document. Unlike the XML error, this message is a template that includes err.message, so the actual parser reason (syntax error, unknown function, bad axis) is surfaced to the user.

Source

Thrown at src/core/operations/XPathExpression.mjs:68

        let doc;
        try {
            doc = new xmldom.DOMParser({
                errorHandler: {
                    fatalError(e) {
                        throw e;
                    }
                }
            }).parseFromString(input, "application/xml");
        } catch (err) {
            throw new OperationError("Invalid input XML.");
        }

        let nodes;
        try {
            nodes = xpath.parse(query).select({ node: doc, allowAnyNamespaceForNoPrefix: true });
        } catch (err) {
            throw new OperationError(`Invalid XPath. Details:\n${err.message}.`);
        }

        const nodeToString = function(node) {
            return node.toString();
        };

        return nodes.map(nodeToString).join(delimiter);
    }

}

export default XPathExpression;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Read err.message in the thrown OperationError — it states the exact parser complaint; fix that syntax (unbalanced quotes, predicates, axes).
2. Validate the query with a standalone XPath 1.0 tester against the same document.
3. Prefer XPath 1.0 constructs; replace XPath 2.0+ features (types, sequences, xquery-style) with 1.0 equivalents.
4. Ensure predicate brackets and string quotes are balanced and properly escaped in the recipe JSON.

Example fix

// before
chef.bake(xml, [{op:"XPath Expression", args:["//item[name='Widget","\n"]}]); // unbalanced quote
// after
chef.bake(xml, [{op:"XPath Expression", args:["//item[name='Widget']","\n"]}]);

// Validate XPath syntax against a tiny sample doc before baking
function validXPath(q) { try { require("xpath").parse(q).select({node: sampleDoc}); return true; } catch { return false; } }

const isBalancedXPath = (q) => { const o=(q.match(/\[/g)||[]).length, c=(q.match(/\]/g)||[]).length; return o===c; };

try { result = chef.bake(input, recipe); } catch (e) { if (/Invalid XPath/.test(e.message)) { console.error(e.message); /* show err.message detail, fix query */ } else throw e; }

When it happens

Trigger: args[0] (the XPath query) is syntactically invalid or uses constructs the xpath library does not support — unbalanced brackets, undefined functions, namespace prefixes without bindings (though allowAnyNamespaceForNoPrefix is enabled), or invalid predicates.

Common situations: Typing an XPath by hand in the query field; copying an XPath 2.0/3.0 expression (e.g. using xs:string, for-expressions) that the 1.0 engine rejects; quoting issues when the query is embedded in a recipe JSON.

Related errors

• Invalid input XML.
• Could not extract EXIF data from image: ${err}
• Unknown Frame Identifier: ${id}
• Unable to parse YAML: ${err}

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/549bb86e00655d91. Report an issue: GitHub.