TL; DR: We’re saying a brand new open supply sort checker for Hack, referred to as Hakana.
Slack launched in 2014, constructed with loads of love and likewise loads of PHP code.
We began migrating to a unique language referred to as Hack in 2016. Hack was created by Fb after that they had struggled to scale their operations with PHP. It provided extra type-safety than PHP, and it got here with an interpreter (referred to as HHVM) that would run PHP code sooner than PHP’s personal interpreter.
A lot has modified in PHP-land since we switched. PHP is quicker than it was once, and it has borrowed a lot of Hack options (comparable to constructor property promotion). Quite a lot of the PHP group has additionally embraced sort checking — there are actually some nice third-party sort checkers to select from.
Sticking with Hack has given us entry to extra runtime velocity boosts, performance-enhancing language constructs like `async`, and a typechecker that’s extra strict by default than PHP typecheckers. However we’ve missed out on options offered by PHP typecheckers, together with the power to customise sort inference guidelines to search out points particular to our codebase and automatic safety vulnerability detection.
Slack has a whole bunch of builders writing Hack. We need to give them the very best expertise, so final yr we began constructing a kind checker that would fill these gaps.
We’ve dubbed that static evaluation software Hakana, and it’s now available on GitHub!
Hakana relies on Psalm, an open-source PHP static evaluation software I created, and it’s written in Rust. Hakana re-uses a Hack parser that’s bundled with the Hack interpreter.
A bonus of writing it in Rust: with a little bit of prodding, Hakana can run nearly anyplace. For instance, it runs in your web browser through WASM.
How we use Hakana
At Slack we run Hakana in CI to implement good code conduct in a variety of areas. Right here’s an incomplete checklist:
- It prevents unused features and unused non-public strategies.
- It prevents unused assignments inside closures.
- It detects each unimaginable and redundant type-checks.
- It warns us about potential SQL-injection assaults and cross-site scripting vulnerabilities (extra on this beneath).
- It prevents misuse of inside Slack APIs (through plugin hooks).
We additionally use Hakana to automate type-aware API migrations (once more through plugin hooks) and to delete unused features in bulk. Because of Rust, these whole-codebase migrations are comparatively fast.
Safety
PHP makes it very easy to make a dynamically-rendered web site. PHP additionally makes it very easy to create an totally insecure dynamically-rendered web site.
Hack improves on this barely, by supporting a system for producing HTML output referred to as XHP. XHP is secure-by-default in opposition to cross-site scripting assaults, but it surely doesn’t cease you from leaking buyer information, and Hack doesn’t stop you from capturing your self within the foot with a variety of different safety vulnerabilities.
For a number of causes (together with compliance obligations) Slack wanted a software that would uncover these vulnerabilities. Psalm, the sort checker that Hakana relies on, already does safety evaluation, so it was comparatively easy so as to add safety evaluation to Hakana as effectively.
Hakana isn’t the primary safety evaluation software for Hack — for years, Fb has been utilizing an inside, closed-source software called Zoncolan — however Hakana is the primary that everybody can use.
Hakana works in a lot the identical approach as Zoncolan. It examines how information can movement between totally different features in a codebase, and checks if attacker-controlled information can present up in locations it shouldn’t.
Thus far, Hakana has discovered a lot of exploitable vulnerabilities in manufacturing code at Slack (that have been instantly fastened, and we checked our logs to make sure that the vulnerabilities had not really ever been exploited).
Safety within the sort system
Hakana’s safety evaluation mode is a type of interprocedural evaluation — it seems on the approach information flows between features. Hakana additionally helps detecting one sort of vulnerability (SQL injection) through intraprocedural evaluation, simply by inspecting varieties at perform boundaries.
To do that, Hakana borrows the idea of literal string varieties from Psalm. In Hack code we are able to outline a kind alias:
<<HakanaSpecialTypesLiteralString()>> sort db_query_string = string;
Although the official Hack typechecker simply treats this as a string, Hakana treats it as a particular sort `literal-string`, a subtype of string that may solely be concatenated or interpolated with different literal-strings. Passing a string right into a perform that expects a literal-string causes Hakana to emit an error:
perform get_id_query(string $id): db_query_string
return "choose * from customers the place id = '$id'";
// Error: The sort `string` is extra basic
// than the declared return sort `literal-string`
Extending Hakana
PHP static evaluation instruments are usually highly-customisable. Customisable static evaluation is absolutely helpful for PHP, as a result of its interpreter permits plenty of methods (e.g. magic methods) that may confound one-size-fits-all static evaluation instruments.
Most of these methods don’t work in Hack code, so there’s far much less of a necessity for customisable static evaluation. Even so, we’ve discovered loads of worth in extending Hakana with plugins.
For instance, we use a customized plugin to inform Hakana {that a} technique name on our inside Consequence object, $some_result->is_ok(), is equal to the extra verbose $some_result is ResultSuccess<_> typecheck.
We additionally use customized plugins to carry out type-aware migrations at velocity throughout all the codebase.
Constructing a plugin system for Rust just isn’t easy — our customized model of Hakana wraps the open-source core as a library, utilizing its plugin hooks the place obligatory — but it surely’s an vital function for us.
Pace
Hakana was tailored from Psalm, a kind checker written in PHP. Whereas PHP is quick for an interpreted language, it may possibly’t compete with a compiled software. To research a codebase of Slack’s measurement — many thousands and thousands of strains of code — we wanted a software that’s as quick as potential.
Hakana, written in Rust, runs about 5x sooner than the PHP-based software on which it’s modeled.
We haven’t spent a lot time tuning efficiency, however when analyzing the total Slack codebase (about 5 million strains of code) efficiency is on par with the official Hack typechecker. That’s ok for us, for now.
Why open-source Hakana?
Hack type of seems like PHP however with extra varieties. In that respect it’s been in comparison with TypeScript. However not like TypeScript, which compiles right down to JavaScript, Hack requires its customers to alter loads of their server infrastructure too.
As a result of that prime switching price, right now Hack is just used at a number of firms. It’s potential that no one else apart from Slack may have a purpose to make use of Hakana.
Even so, there are a number of explanation why we expect it’s price open-sourcing:
- 🔍 The broader programming language group could have helpful enter — particularly in the case of safety evaluation.
- 🤝 Psalm, one other open-source software, was the idea for Hakana. By open-sourcing our personal software we’re returning the favor.
- 🏢 Although it wouldn’t be simple, firms with extraordinarily massive PHP codebases may take into account forking Hakana and altering it to investigate PHP code.
Conclusion
Slack is an indispensable software for thousands and thousands world wide. Hack is now an integral a part of Slack, and so we’ve created a software that we hope will grow to be indispensable to our Hack builders. We’re open-sourcing it today with the hope that others will discover it helpful and fascinating.
