Skip to content

Conversation

@janedbal
Copy link
Contributor

@janedbal janedbal commented Jul 10, 2025

Imagine you want to delete just last entry, but all your rows disappear:

$this->entityManager->createQueryBuilder()
            ->delete(MyEntity::class, 'e')
            ->orderBy('e.createdAt', 'ASC')
            ->setMaxResults(1); // limit ignored silently

I believe Doctrine should protect developers from doing destructive operations by not silently omitting crucial part of query builder (LIMIT, although named setMaxResults).

      This fixes a dangerous bug where LIMIT is silently ignored in DELETE
      operations, potentially causing developers to delete all rows instead
      of just the intended subset. The setMaxResults() method would be
      silently omitted from the final query, making operations like
      delete last entry accidentally delete entire tables.
@janedbal janedbal force-pushed the prevent-delete-limit-misuse branch from 06ce8b0 to 79d4cfd Compare July 10, 2025 15:31
@greg0ire greg0ire added this to the 3.6.0 milestone Jul 12, 2025
@greg0ire greg0ire merged commit d583460 into doctrine:3.6.x Jul 12, 2025
85 checks passed
@greg0ire
Copy link
Member

Thanks @janedbal !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants