Protect what matters – even after you're gone. Make a plan for your digital legacy today.
Forum Discussion
Solved
1Password Chrome extension is incorrectly manipulating <code> blocks
The latest 1Password Chrome extension is incorrectly manipulating the DOM within <code> blocks on static pages. It looks it's using prism.js to try to add syntax highlighting to <code> blocks on the ...
Hey everyone! I want to thank everyone who called our attention to this and explain what happened and what we’re doing about it.
What happened: Prism.js is a syntax-highlighting library we use for our Labs Snippets feature. While optimizing our build to reduce bundle size, we unintentionally bundled Prism.js into the extension in a way that caused it to run on pages where it shouldn’t, which interfered with code formatting on certain sites. We apologize for the inconvenience this caused.What we’re doing about it: We’ve completed the fix and submitted it to the Chrome Web Store, along with Firefox, Edge, and our other supported extension storefronts. Rollout timing depends on each store’s review process, but we expect it to land over the next few days.
We want to emphasize that vault security was not impacted. At 1Password, protecting our customers’ privacy, passwords, and credentials is our highest priority.
We’ll be publishing a postmortem covering what went wrong, the timeline, and the concrete changes we’re making to how we build and release future browser extension updates.
The extension injects a script (injected.js) that calls highlightAllUnder(). The script then uses innerHTML on the matched code elements, mutating the host page DOM after hydration and interfering with existing syntax highlighters.
As a result, all code blocks matching the following selectors are re-highlighted:
code[class*="language-"], [class*="language-"] code, code[class*="lang-"], [class*="lang-"] code
These selectors target all <code> elements that are marked for syntax highlighting by matching either language-* or lang-* classes, whether the class is applied directly to the <code> element or to one of its parent containers
yah my PHP code basically removes all the language- / lang- references from code blocks. I don't need them as i'm using a server-side rendered syntax highlighting, but it was there for github support etc.
