Slack 4.0.0 doesn't contain src/static/ssb-interop.js

[sammorley-short]

I just tried to install this for Slack 4.0.0 (downloaded via the Mac OSX App Store) and it failed to find the correct file.

When I searched the file directory, no ssb-interop.js file was found:

Slack.app $ sudo find . -name '*.js'                                                                                                                                                                                                                                                                       
Password:
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/popups/shared.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/background.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/backend.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/panel.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/main.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/inject.js
./Contents/Resources/app.asar.unpacked/dist/static/extensions/react-devtools/build/contentScript.js

Any ideas which file to point it to instead?

[sdbuch]

A colleague provided a link to this issue in another repo, where the same problem has been solved. It seems (at least on OSX) one needs to have npm installed, and then one can unpack the .asar file in Slack 4.0 using npx, inject math-with-slack, then repack it.

[fsavje]

I will take a look at this as soon as possible, but that will unfortunately be a few weeks.

[fsavje]

Took a look at this today. Turns out that Slack has added a Content Security Policy to avoid script injections. One can inject meta tags in the webapp by unpacking and repacking the asar file as suggested by @hwagyesa . However, it does not load the MathJax script from the CDN:

/Applications/Slack.app/Contents/Resources/app.asar/dist/ssb-interop.bundle.js:40
Refused to load the script 'https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.5/MathJax.js' because it violates the following Content Security Policy directive:
"script-src 'self' https://a.slack-edge.com/ https://cfr.slack-edge.com/ https://fst.slack-edge.com/ 'sha256-HtosUFirHdHvZwGXLdjtfHXYVEjfNmDyX7ffscLm7qw=' 'sha256-V3pNBo9vFI47lnzeFlyJVDxtN3Yf0X6UgalmXzoA69U=' 'sha256-XVjf1UrB+S9bTulVsVW6RjmlY9eDXYYpMiNpLNbVBC0=' 'sha256-F1YT8S1ELkeOyM7rwIMIkVMS8a8FVeXoxmlDjUWZ7Rw=' 'sha256-bnzwnkVhpJR3UZDeyqmzR5+Vty3+pxQYDebbeatN4pU=' 'sha256-NKJOlWPHN59LLYioFQrsjETUtZ+C2AH7plCQfLp7ItY=' 'sha256-D+/bcNwAmFYJ9CfMh57ykwI2161k02TzQhHgIuPRv0I=' 'sha256-jvnF/vs0XdFoP8ZslmhYkCiX84ifYfYKhsPLItnQ+po=' 'sha256-r04w7sZJG0w7qP3YQWJQqrWEAltzCG24RNqrNlDmL6o=' 'sha256-G47a8SPvyDeMvcflK35cUDWqZ6qVRoCf5Z3K0evCOzU=' 'sha256-gZRnrJgs9oG1IkDd5eWANg4/vxp66C0/LYib66mK6Ng=' 'sha256-UvgDsssAGwGDwJDr31x/G3Q7Fuy1B7S5Fw1uHsgBKlE=' 'sha256-sPqPkLDIPKNAk2Vqyp4vscB38LWqm07HVzPEUq6lct4=' 'sha256-5DB6q76v13BY+HEvVt9XeNU1zDEeA4U0De5HHiib54U=' 'sha256-Tu41NFywTKucDrnDukVaLIvsMTz7LqDJswN066TfHNQ=' 'sha256-M+GeuEwdHgLK+IB+9Hmhf8mIrHIv6oKp7xEfGJGmmPY='".

As I've understood it, it isn't possible to modify the CSP on the run, so it seems that using a CDN for script delivery is out of the picture. I also tried injecting a local copy of MathJax, but it was ignored because it wasn't in the electron manifest (and I'm unsure whether it would circumvent the CSP in any case). I guess it technically would be possible to inject the full MathJax library in the same way as the meta tags are injected now, but that is not feasible given that MathJax is over 100 mb.

Does anyone have any ideas on a way forward on this?

[sdbuch]

The unpack-inject-repack scheme is working for me in the latest version of App Store Slack provided I follow the suggestion in this comment before injecting. There is some discussion of this issue here, but it seems it is unclear why changing this setting helps. When using the version of the app downloaded from Slack's website, the unpack-inject-repack scheme was working for me even without changing the bootSonic setting. Based on the information you've posted, though, it looks like this kind of workaround likely won't be viable for long.

[fsavje]

@hwagyesa Could you clarify: do you manage to get math-with-slack running with this method or slack-dark-mode?

[sdbuch]

@fsavje Both math-with-slack and slack-dark-mode work for me (and at least one of my colleagues) with this method. The script I am using with math-with-slack can be found in my fork of the repository.

[fsavje]

Thanks!

Seems this route will work on Mac OS at least. If anyone tests it out on Linux or Windows, please report the results here.

Working on a python script to avoid installing Node.js. In the meanwhile, manually unpacking and packing app.asar using node.js will work.

[bangconghuynh]

@hwagyesa's route works on Linux too.

[Dr-Irv]

I have Windows, but @hwagyesa didn't update the Windows version of the install script, so I can't test it. Looking forward to your python script install

[erikvannimwegen]

Dear fsavje,
would it be possible to write a description for non-experts on how to get math-with-slack working on Mac OSX? We use an enormous amount of latex in our slack discussions and since the last update of Slack our life has been a misery. I understand from your exchange with hwagyesa that there is a solution for Mac OS but the description is too technical for me to understand what I need to do to get it working. Thanks so much!

[fsavje]

Hi @erikvannimwegen. I don't know if I can give anymore detailed instructions than those by @hwagyesa. However, I hope to have a draft version of the updated script up during the weekend.

[erikvannimwegen]

Ok great.. if there will be an updated version soon then I guess I don't need to learn.
But just so know, for a lay user it is completely unclear what it means to 'unpack' an .asar file (or what .asar file @hwagyesa refers to), how to do this unpacking 'in Slack 4.0', how to then 'inject' the script, or how to then 'repack it' afterwards (or even what precisely 'it' is in this context). I understand that I could research online until I do know what these things are, but I guess I was hoping there was a way to give 4 or 5 concrete command line commands that together would accomplish those steps. Thanks in any case for the extremely valuable plugin.

[sdbuch]

Dear @erikvannimwegen, you can perform the following steps to use my script, working for me and others on OSX:

1. Run in a terminal brew install npm (download Homebrew if you don't have it);
2. Clone my fork of @fsavje's math-with-slack repository;
3. Run the math-with-slack.sh script like usual.

The quality of my code is much worse than @fsavje's. If this seems problematic you may wait for his upcoming script.

[fsavje]

A draft version of the python script is up now: https://github.com/fsavje/math-with-slack/tree/v3 It should work with both Python 2.7 and 3. It has, however, not been tested on Windows or Linux. Please let me know if it doesn't work.

It seems that Slack 4.0.1 overwrites the local settings JSON file. Any ideas on circumvent this would be welcomed.