gchq/CyberChef · error · OperationError

Unexpected input found

Error message

Unexpected input found

What it means

The expect() helper reads N characters and checks them against an expected literal delimiter. This fires when the parsed structure has a delimiter or structural marker that does not match the PHP serialization grammar — e.g., a missing semicolon after a scalar, or a missing brace in an array.

Source

Thrown at src/core/operations/PHPDeserialize.mjs:91

                    if (char === until) {
                        break;
                    } else {
                        result += char;
                    }
                }
                return result;

            }

            /**
             * Read characters from the input that must be equal to `expect`
             * @param expect
             * @returns {string}
             */
            function expect(expect) {
                const result = read(expect.length);
                if (result !== expect) {
                    throw new OperationError("Unexpected input found");
                }
                return result;
            }

            /**
             * Helper function to handle deserialized arrays.
             * @returns {Array}
             */
            function handleArray() {
                const items = parseInt(readUntil(":"), 10) * 2;
                expect("{");
                const result = [];
                let isKey = true;
                let lastItem = null;
                for (let idx = 0; idx < items; idx++) {
                    const item = handleInput();
                    if (isKey) {
                        lastItem = item;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Compare the input against a reference serialization produced by PHP's serialize() to spot delimiter mismatches
2. Check that every scalar value ends with ';' and every array opens with '{' and closes with '}'
3. Validate that string elements follow the pattern s:N:"<N chars>";

// Pre-check: verify basic delimiter structure
function hasValidDelimiters(s) {
  // Scalars should end with ';' and arrays with '{}'
  const opens = (s.match(/\{/g) || []).length;
  const closes = (s.match(/\}/g) || []).length;
  return opens === closes;
}
if (!hasValidDelimiters(input)) {
  throw new Error("Mismatched array braces in serialized data.");
}

try {
  const result = chef.phpDeserialize(input, [true]);
} catch (e) {
  if (/Unexpected input/i.test(e.message)) {
    console.error("Delimiter mismatch — compare against PHP serialize() output");
  } else { throw e; }
}

When it happens

Trigger: Malformed delimiters such as i:5} instead of i:5; (missing semicolon). Array body missing the opening brace: a:2:s:1:"a";i:1; instead of a:2:{s:1:"a";i:1;}. String element missing the closing '";' delimiter pair.

Common situations: Hand-editing a serialized string and introducing a typo. Data corruption from transport or storage. Using a non-standard serialization variant that uses different delimiters.

Related errors

• End of input reached before end of script
• Unknown type: ${kind}
• Invalid recipe
• Invalid marker while parsing JPEG at pos ${stream.position}:
• Unable to parse JPEG successfully

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/b3dd2a3f55f64f51. Report an issue: GitHub.