Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130193
Precedence: list
MIME-Version: 1.0
References: <CAEPPVa312d1LTNjvNTQdcZzue+BU2PV=BgLt7s-AQ2BFn6P13g@mail.gmail.com>
 <CAON3zHCodb4pi+J15uGuKMytV5Tup=mmQa6_FNnWt+F5po51gw@mail.gmail.com> <CAEPPVa2zU5+4po82sOAufaJMtV5WvntMqTz-vH1e+0AJE2gnHg@mail.gmail.com>
In-Reply-To: <CAEPPVa2zU5+4po82sOAufaJMtV5WvntMqTz-vH1e+0AJE2gnHg@mail.gmail.com>
Date: Sat, 28 Feb 2026 00:59:00 +0900
Message-ID: <CAEPPVa32hX8je4WwcbAjqnv8On+1m8Gr9Y6_JV=YhrnevXCSrA@mail.gmail.com>
Subject: Re: [PHP-DEV][DISCUSSION] Limit of code point for grapheme cluster in
 programming languages
To: php internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
From: youkidearitai@gmail.com (youkidearitai)

2026=E5=B9=B42=E6=9C=8824=E6=97=A5(=E7=81=AB) 16:21 youkidearitai <youkidea=
ritai@gmail.com>:
>
> 2026=E5=B9=B42=E6=9C=8824=E6=97=A5(=E7=81=AB) 11:38 Kentaro Takeda <taked=
a@youmind.jp>:
> >
> > Hi Yuya,
> >
> > I think this is a good idea. While spec compliance is generally desirab=
le, DoS via unbounded grapheme clusters is a real threat, and it's reasonab=
le for a language-level implementation to impose practical limits that the =
Unicode spec itself doesn't define. This kind of gap between a general-purp=
ose spec and a concrete implementation is not unusual.
> >
> > The default of 32 code points sounds sensible given that natural langua=
ge grapheme clusters top out well below that.
> >
> > One minor note: it might help to clarify the intended behavior of `grap=
heme_limit_codepoints` a bit more =E2=80=94 for instance, whether it is mea=
nt as a validation check (returning false when a cluster exceeds the limit)=
 or something else.
> >
> > Regards,
> > Kentaro Takeda
> >
> >
> > 2026=E5=B9=B42=E6=9C=8823=E6=97=A5(=E6=9C=88) 20:28 youkidearitai <youk=
idearitai@gmail.com>:
> >>
> >> Hi, Internals
> >>
> >> I noticed grapheme cluster is not limit code points in UAX#29.
> >> https://www.unicode.org/reports/tr29/
> >>
> >> And there is no limit code point in Unicode that confirmed in issue of=
 ICU.
> >> https://unicode-org.atlassian.net/browse/ICU-23302
> >>
> >> So that means create many code points in 1 grapheme cluster,
> >> That is crash for program because computer resource is limited.
> >>
> >> For example, this code is 200MB but 1 grapheme cluster in emoji_bomb.t=
xt
> >> ```
> >> php -r 'echo(mb_trim(str_repeat("\u{200d}\u{1f468}\u{200d}\u{1f466}\u
> >> {200d}\u{1f466}", 10000000), "\u{200d}"));' -d memory_limit=3D600M >
> >> emoji_bomb.txt
> >> ```
> >> (PLEASE BE CAREFUL OPEN IN emoji_bomb.txt BECAUSE MAYBE CRASH)
> >>
> >> So, I think we(php-src, programming language level) need to create new
> >> custom limit function.
> >> My idea is below:
> >>
> >> ```
> >> grapheme_limit_codepoints(string $str, integer $max_codepoints =3D 32)=
: bool
> >> ```
> >>
> >> I don't have heavy opinion that $max_codepoints is 32.
> >> However, 32 code points is enough of grapheme cluster because
> >> human language max code points is maybe Hak=E1=B9=A3hmalawaraya=E1=B9=
=81(=E0=BD=A7) in
> >> 9 code points.
> >>
> >> If need more than code points in grapheme cluster,
> >> Userland can to increase $max_codepoints.
> >>
> >> Please see also my speakerdeck.
> >> https://speakerdeck.com/youkidearitai/limit-of-code-point-for-grapheme=
-cluster
> >>
> >> What do you think about this idea?
> >>
> >> Regards
> >> Yuya
> >>
> >> --
> >> ---------------------------
> >> Yuya Hamada (tekimen)
> >> - https://tekitoh-memdhoi.info
> >> - https://github.com/youkidearitai
> >> -----------------------------
>
> Hi, Kentaro
>
> Thank you very much for your feedback.
>
> > One minor note: it might help to clarify the intended behavior of `grap=
heme_limit_codepoints` a bit more =E2=80=94 for instance, whether it is mea=
nt as a validation check (returning false when a cluster exceeds the limit)=
 or something else.
>
> Okay. I'll show you.
>
> ```
> // something string in $_POST['text']
> // Validate many code points in a grapheme cluster.
> if (grapheme_limit_codepoints($_POST['text'], 32) !=3D=3D true) {
>    throw new InvalidException("Found invalid / many code points in
> grapheme cluster");
> }
>
> // Validate grapheme cluster length
> if (grapheme_strlen($_POST['text']) > 100) {
>   throw new InvalidException("Invalid grater than 100 graphemes");
> }
>
> // do anything...
> ```
> The intention is "count correct graphemes avoid DoS".
> And I want to overcoming to
> https://github.com/symfony/symfony/pull/13527 in grapheme_strlen
> function.
>
> Feel free to more comment.
> Regards
> Yuya.
>
> --
> ---------------------------
> Yuya Hamada (tekimen)
> - https://tekitoh-memdhoi.info
> - https://github.com/youkidearitai
> -----------------------------

Hi, Internals

I created a PoC and RFC.
https://github.com/php/php-src/pull/21311
https://wiki.php.net/rfc/grapheme_limit_codepoints

I tried to ask Unicode that UAX#29 add for limit of codepoint for
grapheme cluster.
Perhaps Unicode adds my suggestion if it is make sense. However, I
don't know what happen.

Anyway, I think make sense that grapheme cluster limits codepoint in PHP si=
de.

Feel free to comment.

Regards
Yuya

--=20
---------------------------
Yuya Hamada (tekimen)
- https://tekitoh-memdhoi.info
- https://github.com/youkidearitai
-----------------------------