anowell

tl;dr

I reported a security bug to Slack. The response was: working as intended

I find the conclusion disappointing. IMO, think twice before adding collaborators on a Slack app intended for supporting local development. They may be able to read your DMs.

Basic idea

Scenario: Alice (dev), Bob (manager), and Eve (dev and eavesdropper) are all part of the same Slack team

anowell

use argon2::{Argon2, PasswordHash};
use axum_extra::extract::cookie::{Cookie, SameSite};
use axum_extra::extract::CookieJar;

async fn login_user(
    ctx: State<ApiContext>,
    Json(data): Json<LoginUser>,
) -> Result<(CookieJar, Json<LoginResponse>)> {
    let user = models::user::get_user_pass_hash(&ctx.db, &data.email)
        .await?

anowell

// All themes need a file called `ui-variables` that extends from the base
// variables and overrides colors, padding, etc. Other plugins import
// `ui-variables` to make their custom CSS react to the current theme.
@import 'base/ui-variables';

@goldenrod: #e8aa14;
@sapphire: #006494;
@magenta: #bf1363;
@onyx: #404040;

anowell

use algorithmia::prelude::*;
use serde::{Serialize, Deserialize};
use std::error::Error;

#[derive(Deserialize)]
pub struct Input { name: String }

#[derive(Serialize)]
struct Output { msg: String }

anowell

use algorithmia::prelude::*;
use serde::{Serialize, Deserialize};
use std::error::Error;

#[derive(Deserialize)]
pub struct Input { name: String }

#[derive(Serialize)]
struct Output { msg: String }

anowell

[dependencies]
csv = { git = "https://github.com/BurntSushi/rust-csv.git" } #"1.0.0-beta.6"
serde = "1.0.38"
serde_derive = "1.0.38"
chrono = { verstion = "0.4.2", features = ["serde"] }
decimal = "2.0.4"

anowell

// Current example without codegen
impl Component for TodoList {
    fn onload(view: &View<Self>) {
        view.query("button").expect("missing todo list button")
            .on(EventType::Click, |mut evt| {
                match evt.app.query("#message") {
                    Some(node) => {
                        let item = TodoItem::new(&node.get("value"));
                        evt.binding.data_mut().items.push(item);
                    }

anowell

(Benchmark disclaimers apply. Don't trust the numbers without double checking my code.)

Scala (functional): 697,099 ns/iter
Scala (for loop):    20,467 ns/iter

Rust (functional):    4,984 ns/iter
Rust (for loop):      4,983 ns/iter // Note: this required adding assertions to prevent bounds checking

C (for loop):         6,172 ns/iter // Note: this used -O2 optimization

anowell

# You'll need at least these dependencies
[dependencies]
algorithmia = "2.0.0"
base64 = "0.3.0"
serde = "0.9.0"
serde_derive = "0.9.0"
serde_json = "0.9.0"
error-chain = "0.9.0"

anowell

use quasar::*;

struct TodoItem {
    label: String,
    complete: bool,
}

struct TodoList {
    items: Vec<TodoItem>,
}