fix: deduplicate fields in OverlappingFieldsCanBeMerged to prevent DoS

The validation rule had O(n²) time complexity when processing queries
with many repeated fields sharing the same response name. A query like
`{ hello hello hello ... }` with thousands of fields caused excessive
CPU usage, exploitable as a denial of service vector.

Fields that are structurally identical (same parent type, field name,
arguments, directives, and selection set) can never conflict with each
other, so we deduplicate them before pairwise comparison.

This ports the graphql-php fix for GHSA-68jq-c3rv-pcrr:
webonyx/graphql-php@b5e7c99

Assisted-by: Claude:claude-fable-5

Author: GHG-bguest

src/graphql/validation/rules/overlapping_fields_can_be_merged.py

@@ -539,8 +539,11 @@ def collect_conflicts_within(
         # (except to itself). If the list only has one item, nothing needs to be
         # compared.
         if len(fields) > 1:
-            for i, field in enumerate(fields):
-                for other_field in fields[i + 1 :]:
+            # Deduplicate structurally identical fields to avoid quadratic blowup
+            # when a query repeats the same field many times.
+            unique_fields = deduplicate_fields(fields)
+            for i, field in enumerate(unique_fields):
+                for other_field in unique_fields[i + 1 :]:
                     conflict = find_conflict(
                         context,
                         cached_fields_and_fragment_spreads,
@@ -558,6 +561,36 @@ def collect_conflicts_within(
                         conflicts.append(conflict)
 
 
+def deduplicate_fields(fields: list[NodeAndDef]) -> list[NodeAndDef]:
+    """Deduplicate structurally identical fields.
+
+    Fields that are structurally identical (same parent type, field name, arguments,
+    directives and selection set) can never conflict with each other, so only one of
+    them needs to take part in the pairwise conflict comparison.
+    """
+    unique: list[NodeAndDef] = []
+    seen: set[str] = set()
+    for field in fields:
+        key = field_fingerprint(field)
+        if key not in seen:
+            seen.add(key)
+            unique.append(field)
+    return unique
+
+
+def field_fingerprint(field: NodeAndDef) -> str:
+    """Build a fingerprint identifying the structure of a given field."""
+    parent_type, node, _ = field
+    parent_type_id = id(parent_type) if parent_type else ""
+    selection_set_id = id(node.selection_set) if node.selection_set else ""
+    fingerprint = f"{parent_type_id}:{node.name.value}:{selection_set_id}"
+    for argument in node.arguments or ():
+        fingerprint += f":{argument.name.value}={print_ast(argument.value)}"
+    for directive in node.directives or ():
+        fingerprint += f":{print_ast(directive)}"
+    return fingerprint
+
+
 def collect_conflicts_between(
     context: ValidationContext,
     conflicts: list[Conflict],

tests/benchmarks/test_validate_repeated_fields.py

@@ -0,0 +1,24 @@
+import pytest
+
+from graphql import (
+    GraphQLField,
+    GraphQLObjectType,
+    GraphQLSchema,
+    GraphQLString,
+    parse,
+    validate,
+)
+
+schema = GraphQLSchema(
+    query=GraphQLObjectType(
+        name="Query",
+        fields={"hello": GraphQLField(GraphQLString)},
+    )
+)
+
+
+@pytest.mark.parametrize("count", [100, 500, 1000, 2000, 3000])
+def test_validate_many_repeated_fields(benchmark, count):
+    document = parse(f"{{ {'hello ' * count}}}")
+    result = benchmark(lambda: validate(schema, document))
+    assert result == []

tests/validation/test_overlapping_fields_can_be_merged.py

@@ -1,9 +1,10 @@
 from functools import partial
 
+from graphql import parse, validate
 from graphql.utilities import build_schema
 from graphql.validation import OverlappingFieldsCanBeMergedRule
 
-from .harness import assert_validation_errors
+from .harness import assert_validation_errors, test_schema
 
 assert_errors = partial(assert_validation_errors, OverlappingFieldsCanBeMergedRule)
 
@@ -1565,6 +1566,30 @@ def does_not_infinite_loop_on_transitively_recursive_fragments():
             """
         )
 
+    def many_repeated_fields_do_not_cause_quadratic_blowup():
+        repeated_fields = "name " * 3000
+        assert_valid(
+            f"""
+            fragment manyRepeatedFields on Dog {{
+              {repeated_fields}
+            }}
+            """
+        )
+
+    def many_repeated_fields_with_conflict_still_detected():
+        repeated_fields = "name " * 100
+        doc = parse(
+            f"""
+            fragment conflictsAmongMany on Dog {{
+              {repeated_fields}
+              name: nickname
+            }}
+            """
+        )
+        errors = validate(test_schema, doc, [OverlappingFieldsCanBeMergedRule])
+        assert errors
+        assert "'name' and 'nickname' are different fields" in errors[0].message
+
     def finds_invalid_case_even_with_immediately_recursive_fragment():
         assert_errors(
             """