Merge pull request #12068 from janedbal/prevent-delete-limit-misuse

QueryBuilder: prevent misuse of DELETE with LIMIT

Author: greg0ire

src/QueryBuilder.php

@@ -547,6 +547,10 @@ public function getFirstResult(): int
      */
     public function setMaxResults(int|null $maxResults): static
     {
+        if ($this->type === QueryType::Delete || $this->type === QueryType::Update) {
+            throw new RuntimeException('Setting a limit is not supported for delete or update queries.');
+        }
+
         $this->maxResults = $maxResults;
 
         return $this;

tests/Tests/ORM/QueryBuilderTest.php

@@ -27,6 +27,7 @@
 use PHPUnit\Framework\Attributes\Group;
 use PHPUnit\Framework\Attributes\WithoutErrorHandler;
 use PHPUnit\Framework\TestCase;
+use RuntimeException;
 
 use function array_filter;
 use function class_exists;
@@ -72,6 +73,26 @@ public function testDeleteSetsType(): void
         $this->assertValidQueryBuilder($qb, 'DELETE Doctrine\Tests\Models\CMS\CmsUser u');
     }
 
+    public function testDeleteWithLimitNotSupported(): void
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('Setting a limit is not supported for delete or update queries.');
+
+        $this->entityManager->createQueryBuilder()
+            ->delete(CmsUser::class, 'c')
+            ->setMaxResults(1);
+    }
+
+    public function testUpdateWithLimitNotSupported(): void
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('Setting a limit is not supported for delete or update queries.');
+
+        $this->entityManager->createQueryBuilder()
+            ->update(CmsUser::class, 'c')
+            ->setMaxResults(1);
+    }
+
     public function testUpdateSetsType(): void
     {
         $qb = $this->entityManager->createQueryBuilder()