Prevent misuse of DELETE with LIMIT in QueryBuilder

      This fixes a dangerous bug where LIMIT is silently ignored in DELETE
      operations, potentially causing developers to delete all rows instead
      of just the intended subset. The setMaxResults() method would be
      silently omitted from the final query, making operations like
      delete last entry accidentally delete entire tables.

Author: janedbal

src/QueryBuilder.php

@@ -547,6 +547,10 @@ public function getFirstResult(): int
      */
     public function setMaxResults(int|null $maxResults): static
     {
+        if ($this->type === QueryType::Delete || $this->type === QueryType::Update) {
+            throw new RuntimeException('Setting a limit is not supported for delete or update queries.');
+        }
+
         $this->maxResults = $maxResults;
 
         return $this;

tests/Tests/ORM/QueryBuilderTest.php

@@ -27,6 +27,7 @@
 use PHPUnit\Framework\Attributes\Group;
 use PHPUnit\Framework\Attributes\WithoutErrorHandler;
 use PHPUnit\Framework\TestCase;
+use RuntimeException;
 
 use function array_filter;
 use function class_exists;
@@ -72,6 +73,26 @@ public function testDeleteSetsType(): void
         $this->assertValidQueryBuilder($qb, 'DELETE Doctrine\Tests\Models\CMS\CmsUser u');
     }
 
+    public function testDeleteWithLimitNotSupported(): void
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('Setting a limit is not supported for delete or update queries.');
+
+        $this->entityManager->createQueryBuilder()
+            ->delete(CmsUser::class, 'c')
+            ->setMaxResults(1);
+    }
+
+    public function testUpdateWithLimitNotSupported(): void
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('Setting a limit is not supported for delete or update queries.');
+
+        $this->entityManager->createQueryBuilder()
+            ->update(CmsUser::class, 'c')
+            ->setMaxResults(1);
+    }
+
     public function testUpdateSetsType(): void
     {
         $qb = $this->entityManager->createQueryBuilder()