Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130238
Precedence: list
MIME-Version: 1.0
References: <CAEPPVa312d1LTNjvNTQdcZzue+BU2PV=BgLt7s-AQ2BFn6P13g@mail.gmail.com>
 <CAON3zHCodb4pi+J15uGuKMytV5Tup=mmQa6_FNnWt+F5po51gw@mail.gmail.com>
 <CAEPPVa2zU5+4po82sOAufaJMtV5WvntMqTz-vH1e+0AJE2gnHg@mail.gmail.com> <CAEPPVa32hX8je4WwcbAjqnv8On+1m8Gr9Y6_JV=YhrnevXCSrA@mail.gmail.com>
In-Reply-To: <CAEPPVa32hX8je4WwcbAjqnv8On+1m8Gr9Y6_JV=YhrnevXCSrA@mail.gmail.com>
Date: Tue, 3 Mar 2026 22:58:31 +0900
Message-ID: <CAEPPVa1Kfr8sREvnCjdV=cvTscvvWqyo-WdnhgW1z70G1svHVA@mail.gmail.com>
Subject: Re: [PHP-DEV][DISCUSSION] Limit of code point for grapheme cluster in
 programming languages
To: php internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
From: youkidearitai@gmail.com (youkidearitai)

2026=E5=B9=B42=E6=9C=8828=E6=97=A5(=E5=9C=9F) 0:59 youkidearitai <youkidear=
itai@gmail.com>:
>
> 2026=E5=B9=B42=E6=9C=8824=E6=97=A5(=E7=81=AB) 16:21 youkidearitai <youkid=
earitai@gmail.com>:
> >
> > 2026=E5=B9=B42=E6=9C=8824=E6=97=A5(=E7=81=AB) 11:38 Kentaro Takeda <tak=
eda@youmind.jp>:
> > >
> > > Hi Yuya,
> > >
> > > I think this is a good idea. While spec compliance is generally desir=
able, DoS via unbounded grapheme clusters is a real threat, and it's reason=
able for a language-level implementation to impose practical limits that th=
e Unicode spec itself doesn't define. This kind of gap between a general-pu=
rpose spec and a concrete implementation is not unusual.
> > >
> > > The default of 32 code points sounds sensible given that natural lang=
uage grapheme clusters top out well below that.
> > >
> > > One minor note: it might help to clarify the intended behavior of `gr=
apheme_limit_codepoints` a bit more =E2=80=94 for instance, whether it is m=
eant as a validation check (returning false when a cluster exceeds the limi=
t) or something else.
> > >
> > > Regards,
> > > Kentaro Takeda
> > >
> > >
> > > 2026=E5=B9=B42=E6=9C=8823=E6=97=A5(=E6=9C=88) 20:28 youkidearitai <yo=
ukidearitai@gmail.com>:
> > >>
> > >> Hi, Internals
> > >>
> > >> I noticed grapheme cluster is not limit code points in UAX#29.
> > >> https://www.unicode.org/reports/tr29/
> > >>
> > >> And there is no limit code point in Unicode that confirmed in issue =
of ICU.
> > >> https://unicode-org.atlassian.net/browse/ICU-23302
> > >>
> > >> So that means create many code points in 1 grapheme cluster,
> > >> That is crash for program because computer resource is limited.
> > >>
> > >> For example, this code is 200MB but 1 grapheme cluster in emoji_bomb=
.txt
> > >> ```
> > >> php -r 'echo(mb_trim(str_repeat("\u{200d}\u{1f468}\u{200d}\u{1f466}\=
u
> > >> {200d}\u{1f466}", 10000000), "\u{200d}"));' -d memory_limit=3D600M >
> > >> emoji_bomb.txt
> > >> ```
> > >> (PLEASE BE CAREFUL OPEN IN emoji_bomb.txt BECAUSE MAYBE CRASH)
> > >>
> > >> So, I think we(php-src, programming language level) need to create n=
ew
> > >> custom limit function.
> > >> My idea is below:
> > >>
> > >> ```
> > >> grapheme_limit_codepoints(string $str, integer $max_codepoints =3D 3=
2): bool
> > >> ```
> > >>
> > >> I don't have heavy opinion that $max_codepoints is 32.
> > >> However, 32 code points is enough of grapheme cluster because
> > >> human language max code points is maybe Hak=E1=B9=A3hmalawaraya=E1=
=B9=81(=E0=BD=A7) in
> > >> 9 code points.
> > >>
> > >> If need more than code points in grapheme cluster,
> > >> Userland can to increase $max_codepoints.
> > >>
> > >> Please see also my speakerdeck.
> > >> https://speakerdeck.com/youkidearitai/limit-of-code-point-for-graphe=
me-cluster
> > >>
> > >> What do you think about this idea?
> > >>
> > >> Regards
> > >> Yuya
> > >>
> > >> --
> > >> ---------------------------
> > >> Yuya Hamada (tekimen)
> > >> - https://tekitoh-memdhoi.info
> > >> - https://github.com/youkidearitai
> > >> -----------------------------
> >
> > Hi, Kentaro
> >
> > Thank you very much for your feedback.
> >
> > > One minor note: it might help to clarify the intended behavior of `gr=
apheme_limit_codepoints` a bit more =E2=80=94 for instance, whether it is m=
eant as a validation check (returning false when a cluster exceeds the limi=
t) or something else.
> >
> > Okay. I'll show you.
> >
> > ```
> > // something string in $_POST['text']
> > // Validate many code points in a grapheme cluster.
> > if (grapheme_limit_codepoints($_POST['text'], 32) !=3D=3D true) {
> >    throw new InvalidException("Found invalid / many code points in
> > grapheme cluster");
> > }
> >
> > // Validate grapheme cluster length
> > if (grapheme_strlen($_POST['text']) > 100) {
> >   throw new InvalidException("Invalid grater than 100 graphemes");
> > }
> >
> > // do anything...
> > ```
> > The intention is "count correct graphemes avoid DoS".
> > And I want to overcoming to
> > https://github.com/symfony/symfony/pull/13527 in grapheme_strlen
> > function.
> >
> > Feel free to more comment.
> > Regards
> > Yuya.
> >
> > --
> > ---------------------------
> > Yuya Hamada (tekimen)
> > - https://tekitoh-memdhoi.info
> > - https://github.com/youkidearitai
> > -----------------------------
>
> Hi, Internals
>
> I created a PoC and RFC.
> https://github.com/php/php-src/pull/21311
> https://wiki.php.net/rfc/grapheme_limit_codepoints
>
> I tried to ask Unicode that UAX#29 add for limit of codepoint for
> grapheme cluster.
> Perhaps Unicode adds my suggestion if it is make sense. However, I
> don't know what happen.
>
> Anyway, I think make sense that grapheme cluster limits codepoint in PHP =
side.
>
> Feel free to comment.
>
> Regards
> Yuya
>
> --
> ---------------------------
> Yuya Hamada (tekimen)
> - https://tekitoh-memdhoi.info
> - https://github.com/youkidearitai
> -----------------------------

Hi, Internals

This topic, I reported Unicode. Then received reply that is below:

> Thank you for your feedback and your interest in Unicode.
> Your feedback will be reviewed by one of Unicode=E2=80=99s working groups=
.
> If appropriate, it may be posted to the PRI feedback page or be made part=
 of a list of general feedback that will be considered for the next quarter=
ly UTC meeting.

My understand, if appropriate PRI(https://www.unicode.org/review/) or UTC.

 I'm going to wait and see.

Regards
Yuya

--=20
---------------------------
Yuya Hamada (tekimen)
- https://tekitoh-memdhoi.info
- https://github.com/youkidearitai
-----------------------------