Add field merging budget

[michaelstaib]

No description provided.

[Copilot]

Pull request overview

This PR adds additional query-hardening limits and validation safeguards to reduce CPU/memory amplification risks (notably directive overloading, fragment traversal/expansion bombs, and overlapping-field merge worst cases), along with corresponding configuration surfaces and tests.

Changes:

• Add a parser limit for directives per “location” (default 4) and wire it through parser option surfaces (core + fusion).
• Introduce a configurable “field merge comparisons” budget for OverlappingFieldsCanBeMergedRule, plus DI/builder configuration hooks and tests.
• Add fragment traversal deduplication logic and new regression tests for fragment bomb scenarios; update an existing snapshot expectation.

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/HotChocolate/Primitives/src/Primitives/ErrorCodes.cs	Adds a new validation error code for merge-budget exhaustion.
src/HotChocolate/Language/test/Language.Tests/Parser/QueryParserTests.cs	Adds tests for directive-per-location limits and alias/field limit scenarios.
src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Directives.cs	Enforces max directives per location during parsing.
src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.cs	Plumbs MaxAllowedDirectives into the UTF-8 parser instance.
src/HotChocolate/Language/src/Language.Utf8/Properties/LangUtf8Resources.resx	Adds localized parser error text for directive limit.
src/HotChocolate/Language/src/Language.Utf8/Properties/LangUtf8Resources.Designer.cs	Adds the generated resource accessor for the new message.
src/HotChocolate/Language/src/Language.Utf8/ParserOptions.cs	Adds MaxAllowedDirectives to parser options (default 4).
src/HotChocolate/Fusion/src/Fusion.Execution/Execution/FusionRequestExecutorManager.cs	Wires directive limit into fusion gateway parser options creation.
src/HotChocolate/Fusion/src/Fusion.Execution/Execution/FusionParserOptions.cs	Exposes MaxAllowedDirectives in fusion parser options.
src/HotChocolate/Fusion/src/Fusion.Execution/DependencyInjection/CoreFusionGatewayBuilderExtensions.Validation.cs	Adds gateway builder API to configure max field-merge comparisons.
src/HotChocolate/Core/test/Validation.Tests/FieldSelectionMergingRuleTests.cs	Adds tests around budget exhaustion/non-exhaustion for field merging.
src/HotChocolate/Core/test/Validation.Tests/DocumentValidatorTests.cs	Adds regression tests for fragment traversal/expansion bombs and inline fragment amplification.
src/HotChocolate/Core/test/Validation.Tests/snapshots/FragmentSpreadsMustNotFormCyclesRuleTests.DoesNotInfiniteLoopOnTransitivelyRecursiveFragment.snap	Updates snapshot output (reduced/changed error emission).
src/HotChocolate/Core/src/Validation/Rules/OverlappingFieldsCanBeMergedRule.cs	Adds budget tracking and reporting for merge comparisons; changes ctor shape.
src/HotChocolate/Core/src/Validation/Options/ValidationOptions.cs	Introduces MaxAllowedFieldMergeComparisons (default 100,000).
src/HotChocolate/Core/src/Validation/Extensions/ValidationBuilderExtensions.cs	Instantiates merge rule via factory to pass the configured budget.
src/HotChocolate/Core/src/Validation/DocumentValidatorContext.cs	Changes fragment traversal bookkeeping (adds “completed” tracking).
src/HotChocolate/Core/src/Types/Execution/Options/RequestParserOptions.cs	Exposes MaxAllowedDirectives for request parsing configuration.
src/HotChocolate/Core/src/Types/Execution/DependencyInjection/RequestExecutorServiceCollectionExtensions.cs	Wires directive limit into core parser option creation.
src/HotChocolate/Core/src/Types/Execution/DependencyInjection/RequestExecutorBuilderExtensions.Validation.cs	Adds builder API to configure max field-merge comparisons.
src/HotChocolate/Core/src/Types.Analyzers/Errors.cs	Renumbers several analyzer diagnostic IDs.

Files not reviewed (1)

• src/HotChocolate/Language/src/Language.Utf8/Properties/LangUtf8Resources.Designer.cs: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.