Hakana: A New Type Checker for Hack

Slack has open-sourced Hakana, a static analysis tool for Hack, the language the company migrated to from PHP in 2016. Hakana is written in Rust and built on Psalm, the PHP static analysis tool, reusing the Hack parser bundled with the Hack interpreter. The tool is now available on GitHub, and a WASM build runs in the browser.

The project fills gaps Slack found in the official Hack type checker. While Hack offered stricter typing and runtime performance gains over PHP, its tooling lacked the customization and security analysis features available in the PHP ecosystem. Hakana addresses those needs with plugin support and built-in vulnerability detection.

Enforcing Code Quality in CI

Slack runs Hakana in CI to catch a range of issues:

  • Unused functions and unused private methods
  • Unused assignments inside closures
  • Impossible and redundant type checks
  • Potential SQL-injection and cross-site scripting vulnerabilities
  • Misuse of internal Slack APIs via plugin hooks

The tool also powers type-aware API migrations and bulk deletion of unused functions across the entire codebase. The Rust implementation keeps these whole-codebase operations relatively fast.

Security Analysis

XHP, Hack's system for generating HTML output, is secure-by-default against cross-site scripting, but it doesn't protect against data leaks or other vulnerability classes. Hakana's security analysis mode examines how data flows between functions in a codebase to determine whether attacker-controlled data can reach unsafe locations.

This interprocedural analysis mirrors the approach of Zoncolan, Facebook's internal security tool for Hack. Hakana is the first open-source tool to offer this capability for the language. At Slack, it has already uncovered exploitable vulnerabilities in production code, which were patched immediately and verified against logs to confirm they had never been exploited.

SQL Injection Detection Through Types

For SQL injection specifically, Hakana can also work intraprocedurally at function boundaries. It borrows Psalm's concept of literal string types, defined in Hack as a type alias:

<<Hakana\SpecialTypes\LiteralString()>>
type db_query_string = string;

The official Hack type checker treats this as a plain string, but Hakana recognizes it as literal-string — a subtype of string that can only be concatenated or interpolated with other literal-strings. Passing a regular string where a literal-string is expected triggers an error:

function get_id_query(string $id): db_query_string {
    return "select * from users where id = '$id'";
    // Error: The type `string` is more general
    // than the declared return type `literal-string`
}

Plugin System

PHP static analysis tools gained a reputation for customizability because PHP's interpreter permits tricks like magic methods that confound generic analyzers. Hack code has fewer such constructs, but Slack still found plugins valuable for its specific needs.

One custom plugin teaches Hakana that a method call on an internal Result object — $some_result->is_ok() — is equivalent to the longer type check $some_result is ResultSuccess<_>. Other plugins enable type-aware migrations across the entire codebase.

Building a plugin architecture in Rust is not trivial. Slack's internal version wraps the open-source core as a library and uses its plugin hooks where needed, but the plugin capability was important enough to justify that effort.

Performance

Hakana's original model, Psalm, is written in PHP. For analyzing Slack's codebase — millions of lines of code — the team needed more speed. Hakana's Rust implementation runs about 5x faster than its PHP forebear.

Even without performance tuning, analyzing the full Slack codebase (about 5 million lines) is on par with the official Hack type checker, which the team considers sufficient for now.

Why Open Source?

Hack is sometimes compared to TypeScript because it looks like PHP but with more types. Unlike TypeScript, however, Hack requires users to significantly change their server infrastructure. That high switching cost means Hack is used at only a few companies — possibly none besides Slack would have a reason to adopt Hakana.

Still, there are reasons to release it:

  • The wider programming language community may offer input, particularly on security analysis
  • Hakana itself is based on Psalm, an open-source tool — open-sourcing returns the favor
  • Companies with very large PHP codebases might fork Hakana and adapt it for PHP analysis