[php-src] Issue #20414: Spoofchecker does NOT recognize zero-width spaces

From: Date: Fri, 07 Nov 2025 14:55:12 +0000
Subject: [php-src] Issue #20414: Spoofchecker does NOT recognize zero-width spaces
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-251187@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/20414 Author: D3strukt0r ### Description https://3v4l.org/9dMTh#v8.4.14 The following code: ```php <?php $values = [ "Zero Width Space" => "MaxMustermann", "Zero Width Space" => "Max\u{200B}Mustermann", "Zero Width Non-Joiner" => "Max\u{200C}Mustermann", "Zero Width Joiner" => "Max\u{200D}Mustermann", "Zero Width No-Break Space" => "Max\u{FEFF}Mustermann", ]; $checker = new \Spoofchecker(); $checks = \Spoofchecker::INVISIBLE | \Spoofchecker::MIXED_NUMBERS | \Spoofchecker::HIDDEN_OVERLAY; $checks |= \Spoofchecker::SINGLE_SCRIPT; $checker->setRestrictionLevel(\Spoofchecker::MODERATELY_RESTRICTIVE); $checker->setAllowedLocales('de,fr,it'); $checker->setChecks($checks); foreach ($values as $check => $value) { echo $check."\n"; var_dump(preg_match('/[\x{200B}\x{200C}\x{200D}\x{FEFF}\x{2060}\x{2061}\x{2062}\x{2063}\x{2064}]/u', $value)); var_dump($checker->isSuspicious($value, $errorCode)); var_dump($errorCode); echo "\n"; } ``` Resulted in this output: ``` Zero Width Space int(1) bool(false) int(0) Zero Width Non-Joiner int(1) bool(false) int(0) Zero Width Joiner int(1) bool(false) int(0) Zero Width No-Break Space int(1) bool(false) int(0) ``` But I expected this output instead: ``` Zero Width Space int(1) bool(true) int(1) Zero Width Non-Joiner int(1) bool(true) int(1) Zero Width Joiner int(1) bool(true) int(1) Zero Width No-Break Space int(1) bool(true) int(1) ``` https://github.com/symfony/symfony/issues/62338 ### PHP Version ```plain PHP 8.4.14 (cli) (built: Oct 24 2025 19:15:19) (NTS) Copyright (c) The PHP Group Built by https://github.com/docker-library/php Zend Engine v4.4.14, Copyright (c) Zend Technologies with Zend OPcache v8.4.14, Copyright (c), by Zend Technologies with Xdebug v3.4.7, Copyright (c) 2002-2025, by Derick Rethans ICU v72.1 ``` ### Operating System _No response_

« previous php.bugs (#251187) next »