Slack 4.0.0 doesn't contain src/static/ssb-interop.js

[sammorley-short]

I just tried to install this for Slack 4.0.0 (downloaded via the Mac OSX App Store) and it failed to find the correct file.

When I searched the file directory, no ssb-interop.js file was found:

Slack.app $ sudo find . -name '*.js'                                                                                                                                                                                                                                                                       
Password:
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/popups/shared.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/background.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/backend.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/panel.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/main.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/inject.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/contentScript.js

Any ideas which file to point it to instead?

[sdbuch]

A colleague provided a link to this issue in another repo, where the same problem has been solved. It seems (at least on OSX) one needs to have npm installed, and then one can unpack the .asar file in Slack 4.0 using npx, inject math-with-slack, then repack it.

[fsavje]

I will take a look at this as soon as possible, but that will unfortunately be a few weeks.

[fsavje]

Took a look at this today. Turns out that Slack has added a Content Security Policy to avoid script injections. One can inject meta tags in the webapp by unpacking and repacking the asar file as suggested by @hwagyesa . However, it does not load the MathJax script from the CDN:

/Applications/Slack.app/Contents/Resources/app.asar/dist/ssb-interop.bundle.js:40
Refused to load the script 'https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.5/MathJax.js' because it violates the following Content Security Policy directive:
"script-src 'self' https://a.slack-edge.com/ https://cfr.slack-edge.com/ https://fst.slack-edge.com/ 'sha256-HtosUFirHdHvZwGXLdjtfHXYVEjfNmDyX7ffscLm7qw=' 'sha256-V3pNBo9vFI47lnzeFlyJVDxtN3Yf0X6UgalmXzoA69U=' 'sha256-XVjf1UrB+S9bTulVsVW6RjmlY9eDXYYpMiNpLNbVBC0=' 'sha256-F1YT8S1ELkeOyM7rwIMIkVMS8a8FVeXoxmlDjUWZ7Rw=' 'sha256-bnzwnkVhpJR3UZDeyqmzR5+Vty3+pxQYDebbeatN4pU=' 'sha256-NKJOlWPHN59LLYioFQrsjETUtZ+C2AH7plCQfLp7ItY=' 'sha256-D+/bcNwAmFYJ9CfMh57ykwI2161k02TzQhHgIuPRv0I=' 'sha256-jvnF/vs0XdFoP8ZslmhYkCiX84ifYfYKhsPLItnQ+po=' 'sha256-r04w7sZJG0w7qP3YQWJQqrWEAltzCG24RNqrNlDmL6o=' 'sha256-G47a8SPvyDeMvcflK35cUDWqZ6qVRoCf5Z3K0evCOzU=' 'sha256-gZRnrJgs9oG1IkDd5eWANg4/vxp66C0/LYib66mK6Ng=' 'sha256-UvgDsssAGwGDwJDr31x/G3Q7Fuy1B7S5Fw1uHsgBKlE=' 'sha256-sPqPkLDIPKNAk2Vqyp4vscB38LWqm07HVzPEUq6lct4=' 'sha256-5DB6q76v13BY+HEvVt9XeNU1zDEeA4U0De5HHiib54U=' 'sha256-Tu41NFywTKucDrnDukVaLIvsMTz7LqDJswN066TfHNQ=' 'sha256-M+GeuEwdHgLK+IB+9Hmhf8mIrHIv6oKp7xEfGJGmmPY='".

As I've understood it, it isn't possible to modify the CSP on the run, so it seems that using a CDN for script delivery is out of the picture. I also tried injecting a local copy of MathJax, but it was ignored because it wasn't in the electron manifest (and I'm unsure whether it would circumvent the CSP in any case). I guess it technically would be possible to inject the full MathJax library in the same way as the meta tags are injected now, but that is not feasible given that MathJax is over 100 mb.

Does anyone have any ideas on a way forward on this?

[sdbuch]

The unpack-inject-repack scheme is working for me in the latest version of App Store Slack provided I follow the suggestion in this comment before injecting. There is some discussion of this issue here, but it seems it is unclear why changing this setting helps. When using the version of the app downloaded from Slack's website, the unpack-inject-repack scheme was working for me even without changing the bootSonic setting. Based on the information you've posted, though, it looks like this kind of workaround likely won't be viable for long.

[fsavje]

@hwagyesa Could you clarify: do you manage to get math-with-slack running with this method or slack-dark-mode?

[sdbuch]

@fsavje Both math-with-slack and slack-dark-mode work for me (and at least one of my colleagues) with this method. The script I am using with math-with-slack can be found in my fork of the repository.

[fsavje]

Thanks!

Seems this route will work on Mac OS at least. If anyone tests it out on Linux or Windows, please report the results here.

Working on a python script to avoid installing Node.js. In the meanwhile, manually unpacking and packing app.asar using node.js will work.

[bangconghuynh]

@hwagyesa's route works on Linux too.

[Dr-Irv]

I have Windows, but @hwagyesa didn't update the Windows version of the install script, so I can't test it. Looking forward to your python script install

[erikvannimwegen]

Dear fsavje, would it be possible to write a description for non-experts on how to get math-with-slack working on Mac OSX? We use an enormous amount of latex in our slack discussions and since the last update of Slack our life has been a misery. I understand from your exchange with hwagyesa that there is a solution for Mac OS but the description is too technical for me to understand what I need to do to get it working. Thanks so much!

[fsavje]

Hi @erikvannimwegen. I don't know if I can give anymore detailed instructions than those by @hwagyesa. However, I hope to have a draft version of the updated script up during the weekend.

[erikvannimwegen]

Ok great.. if there will be an updated version soon then I guess I don't need to learn. But just so know, for a lay user it is completely unclear what it means to 'unpack' an .asar file (or what .asar file @hwagyesa refers to), how to do this unpacking 'in Slack 4.0', how to then 'inject' the script, or how to then 'repack it' afterwards (or even what precisely 'it' is in this context). I understand that I could research online until I do know what these things are, but I guess I was hoping there was a way to give 4 or 5 concrete command line commands that together would accomplish those steps. Thanks in any case for the extremely valuable plugin.

[sdbuch]

Dear @erikvannimwegen, you can perform the following steps to use my script, working for me and others on OSX:

1. Run in a terminal brew install npm (download Homebrew if you don't have it);
2. Clone my fork of @fsavje's math-with-slack repository;
3. Run the math-with-slack.sh script like usual.

The quality of my code is much worse than @fsavje's. If this seems problematic you may wait for his upcoming script.

[fsavje]

A draft version of the python script is up now: https://github.com/fsavje/math-with-slack/tree/v3 It should work with both Python 2.7 and 3. It has, however, not been tested on Windows or Linux. Please let me know if it doesn't work.

It seems that Slack 4.0.1 overwrites the local settings JSON file. Any ideas on circumvent this would be welcomed.

[rcurr]

@fsavje I've had a quick try with "math-with-slack.py" on Ubuntu 16.04 and haven't been able to get it to work.

I'm using the slack/slack-desktop packages (version 4.0.1) from the https://packagecloud.io/slacktechnologies/slack/debian/ repository (originally from https://slack.com/downloads/linux). I've ran the script and it changes app.asar. "grep fsavje app.asar" matches, though if I unpack then file with "npx asar extract app.asar /tmp/extract" the "ssb-interop.bundle.js" file is missing.

Some things I noticed with the script:

• "sys.platform == 'linux'" won't work with python 2.7 on my platform, sys.platform returns "linux2". Perhaps use "sys.platform.startswith('linux')"?
• If the user has not yet launched slack, the local-settings.json file may not yet exist for them. At the moment it seems that he script won't run on Linux if that file doesn't exist.
• Can you add an option to not create the .mwsbak file?

[Dr-Irv]

I submitted a pull request #53 to make the python script work with Windows.

[claresinger]

A draft version of the python script is up now: https://github.com/fsavje/math-with-slack/tree/v3 It should work with both Python 2.7 and 3. It has, however, not been tested on Windows or Linux. Please let me know if it doesn't work.

Hi, I'm using Mac OSX. Running your .py script gives me this permission denied error. How can I make sure the script has write permissions?

[Errno 13] Permission denied: '/Applications/Slack.app/Contents/Resources/app.asar.mwsbak'
Cannot make backup. Make sure the script has write permissions.

[terasakisatoshi]

I've got the following error even the latest releases. An error message ✘ Cannot find Slack installation. shows on my Mac terminal

[terasakisatoshi]

Ah ... Sorry.

I should have tried the script below: https://github.com/fsavje/math-with-slack/blob/v3/math-with-slack.py

just run

$ sudo python math-with-slack.py
sudo python mathwiths.py 
Using Slack installation at: /Applications/Slack.app/Contents/Resources/app.asar
Using local settings file at: /Users/myuser/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack/local-settings.json
Install successful. Please restart Slack.

works for me. Thank you @fsavje

[thisiscam]

It seems that Slack 4.0.1 overwrites the local settings JSON file. Any ideas on circumvent this would be welcomed.

My temporary fix was to hijack /Applications/Slack.app/Contents/MacOS/Slack.

Basically, create rename this Slack executable to Slack_bk, then create a shell script in place of that:

#!/bin/sh
# Contents for /Applications/Slack.app/Contents/MacOS/Slack

tmp_dir=$(mktemp -d)
prev_dir=$(pwd)
cd $tmp_dir
curl -O https://github.com/fsavje/math-with-slack/blob/v3/math-with-slack.py
python math-with-slack.py
cd $prev_dir
rm $tmp_dir

script_path="$( cd "$(dirname "$0")" ; pwd -P )"

exec "${script_path}/Slack_bk" "$@"

Make it executable:

chmod +x /Applications/Slack.app/Contents/MacOS/Slack

[alanocallaghan]

Trying this on Ubuntu 18.04.3 now, running just the python file I get:

sudo python ./math-with-slack.py 
Could not find Slack's app.asar file. Please provide path.

if I supply the app file I get a missing local settings file:

sudo python ./math-with-slack.py -a /usr/lib/slack/slack
Could not find local-settings.json. Please provide path.

I can't find any info on where this file might be on Ubuntu.

EDIT: this call seems to have worked for me, in case it helps anyone:

sudo python ./math-with-slack.py -a /usr/lib/slack/resources/app.asar -s /home/alan/.config/Slack/local-settings.json

[alanocallaghan]

Actually it ran successfully but didn't change anything.

[PeganovAnton]

Actually it ran successfully but didn't change anything.

Same on Ubuntu 16.04

[PeganovAnton]

Hello! I also have a problem with unpacking app.asar.

user@host:~$ npx  asar --verbose extract /usr/lib/slack/resources/app.asar asar_extracted/
npx: installed 21 in 2.442s
Unexpected token function

[pturne7]

A draft version of the python script is up now: https://github.com/fsavje/math-with-slack/tree/v3 It should work with both Python 2.7 and 3. It has, however, not been tested on Windows or Linux.

Has anyone successfully used this script for Windows? When I run it in Python Shell, I receive a message saying `Not implemented,' and that's it.

I would appreciate input from anyone who has successfully installed math-with-slack on Windows following the recent protections against code injections.

[alanocallaghan]

The not implemented message means just that; nobody's implemented the functionality in the script on Windows.

[Dr-Irv]

@pturne7 I submitted a pull request at https://github.com/fsavje/math-with-slack/pull/53 that makes it work on Windows.

I believe that if you download the file math-with-slack.py from here: https://github.com/fsavje/math-with-slack/blob/d15ce28d8394f8a021b88d793a222b80e8566b28/math-with-slack.py

then you'll be able to run it on Windows.

[abogatskiy]

Slack 4.2.0 seems to have finally killed the python script as well (I'm on Mac). The error is KeyError: 'ssb-interop.bundle.js'. And Slack stops launching after this.

[sdbuch]

I poked around this issue today... it seems that Slack 4.2 has removed old code (including ssb-interop.bundle.js and other files...) that was used to run whatever CSP-free legacy interface was used when setting bootSonic = "never" in the local_settings.json file, so indeed as @level1807 stated this workaround is no longer viable.

It seems that the right place to inject code is now main-preload-entry-point.bundle.js; but as @fsavje stated above, CSP is turned on by default in new versions of Slack, and it blocks the injected code from accessing the Cloudflare CDN. I combed over the source for a while looking for places where the CSP settings might be editable (looking for things like script-src...), but had no success. Does anyone else have any leads on whether it is possible to disable CSP in Slack?

[MAEA2]

I encontered the same error in Slack 4.2.0. I ran math-math-with-slack.py, then I got these error.

Using Slack installation at: /Applications/Slack.app/Contents/Resources/app.asar
Using local settings file at: /Users/atsuto/Library/Application Support/Slack/local-settings.json
Traceback (most recent call last):
  File "math-with-slack.py", line 248, in <module>
    ori_ssbinterop_size = json_header['files']['dist']['files']['ssb-interop.bundle.js']['size']
KeyError: 'ssb-interop.bundle.js'