Input Validation

[jugglinmike]

In gh-574, @davidchambers suggested some ideas for refactoring Cheerio's internal isHTML (see below). In the process, we recognized that Cheerio differs from jQuery in the types of strings it accepts in the constructor function, and how it behaves on invalid input.

Input interpretation

For any given string input, both libraries have to decide how it should be interpreted (as HTML or as a CSS selector) and then either accept the string or reject it. The libraries differ in how they make this decision and how accepting they are when accepted either type (Cheerio seems to be generally more lax).

Response to invalid input

Sizzle.js (and therefor jQuery) throws an error in response to invalid input, eg:

$("invalid input <")
Error: Syntax error, unrecognized expression: invalid input <

Cheerio, on the other hand, returns an empty collection and currently has a test to assert this behavior.

The questions I'd like to address with this issue are:

• How exactly does jQuery decide how it will interpret input strings (either as HTML or a CSS selector)?
• Is there any reason for Cheerio to decide differently?
• Should Cheerio throw an error in response to invalid input?

---

From @davidchambers in gh-574:

Bringing it all together:

 exports.isHtml = function(str) {
  var len = str.length;
  return len > 2 && str.charAt(0) === '<' && str.charAt(len - 1) === '>' || /<[\s\S]+>/.test(str);
};

..and:

The anchors aren't restrictive at all, in this case. At first glance the combination of ^[^<]* and [^>]*$ seem intended to prevent strings containing multiple tags from matching, but the text between the first < and the last > can contain any number of tags: [\s\S]+.

[kospl]

Having this baked in Cheerio would be awesome, as now we face the issue that we need to validate user input first before sending to Cheerio.

For example this invalid input:

Check <code> section

will return invalid HTML with Cheerio.