[TEMP][DRAFT] Re-bundle oniguruma

[youkidearitai]

Related: #18467

Maintenance of Oniguruma has ended, so I'll temporarily bundle it.
This pull request is one way of doing it, and this method may not always be adopted.

[bukka]

Considering that Niels already added thumbs down, it needs RFC.

[youkidearitai]

I created a Draft RFC.
https://wiki.php.net/rfc/eol-oniguruma

@alexdowad
What do you have any comments about this issue?

[alexdowad]

@youkidearitai Thanks very much for drawing attention to this issue!

Many thanks to @kkos for his work on maintaining Oniguruma over the years. I'm sure it has been challenging.
@kkos, I don't wish to impose on your time, but if you are available to share a bit of your (extensive) knowledge about Oniguruma, it would be much appreciated.

I think our only options are 1) fork Oniguruma and maintain it ourselves, or 2) drop the mb_regex_* functions from mbstring.

Since PHP already has a built-in extension which bundles PCRE2, dropping Oniguruma would mean that PHP only includes one regex engine, rather than two. From a maintenance perspective, that seems desirable.

At the same time, it seems that Oniguruma does have some features which PCRE2 doesn't. From a quick, online search, it appears that OG:

• Supports EUC-JP, Shift-JIS, and other legacy character encodings directly, while PCRE2 requires UTF-8/16/32.
• Supports multiple regexp syntaxes, including Ruby, Java, etc
• Allows multiple named capture groups with the same name
• Supports "named subexpression call" (\g<name>)
• ...and may have a couple of other features differing from PCRE2.

Looking at the history of OG, it appears there were a number of CVEs in 2019, but since then there have been few.

Code size: ~75,000 lines of C. About 25,000 are for the regexp engine; about 40,000 are Unicode data tables, and another 10,000 to support various text encodings.

@youkidearitai Do you have any ideas about how to find how many users are relying on mb_regex functions?

[youkidearitai]

@alexdowad Thank you very much for investigation!

@youkidearitai Do you have any ideas about how to find how many users are relying on mb_regex functions?

For example, One idea is search to GitHub: https://github.com/search?q=mb_ereg+language%253APHP&type=code&l=PHP
Seems many use cases.

[alexdowad]

Just using Claude to analyze the OG repository and figure out where the key parts are and how they work.

Here's what it came up with: https://gist.github.com/alexdowad/b976a927aa908ca6f2bf76afe3d1a302

[alexdowad]

@youkidearitai As a suggestion, instead of re-bundling the Oniguruma source into php-src, what if we forked OG into the php GitHub organization, and maintained the fork ourselves (security fixes only, no new features whatsoever)?
Then we wouldn't have to kill the mb_regex_* functions.
Or do you prefer to get rid of them?

[youkidearitai]

@alexdowad Indeed, Forks Oniguruma in PHP organization is one way.
Internals mailing list (and me) likes rid them. But, If use case is many, I reconsider rid it.