I am working on a web application backend (completely unrelated to Ethereum) that returns XML in response to certain queries. I have just set up the environment again and came across something weird: displayed in the first tag in the root tag was a <script>, which clearly has no business being there. It looks like this:

/*global Web3*/ cleanContextForImports() require('web3/dist/web3.min.js') const LocalMessageDuplexStream = require('post-message-stream') 
[... too long ...]

I thought the code was broken, but on inspection it was MetaMask javascript code. I have MetaMask installed and running, but this is strange. Does MetaMask rewrite all pages like this? And why would it rewrite XML files, does it not detect HTML? The Content-Type is text/xml.

1 Answer 1


MetaMask does both doctype and suffix checking to only inject in html documents, and not inject in PDFs or XML.

It looks like you've found an edge case that still gets injected in.

You should open a new issue with MetaMask and give as many specific details about your situation as possible, especially if you can provide the xml document in question.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.