fix: deduplicate fields in OverlappingFieldsCanBeMerged to prevent DoS

The validation rule had O(n²) time complexity when processing queries
with many repeated fields sharing the same response name. A query like
`{ hello hello hello ... }` with thousands of fields caused excessive
CPU usage, exploitable as a denial of service vector.

Fields that are structurally identical (same parent type, field name,
arguments, directives, and selection set) can never conflict with each
other, so we deduplicate them before pairwise comparison.

This ports the graphql-php fix for GHSA-68jq-c3rv-pcrr:
webonyx/graphql-php@b5e7c99

Assisted-by: Claude:claude-fable-5

Author: bcmyguest

src/graphql/validation/rules/overlapping_fields_can_be_merged.py

@@ -539,8 +539,11 @@ def collect_conflicts_within(
         # (except to itself). If the list only has one item, nothing needs to be
         # compared.
         if len(fields) > 1:
-            for i, field in enumerate(fields):
-                for other_field in fields[i + 1 :]:
+            # Deduplicate structurally identical fields to avoid quadratic blowup
+            # when a query repeats the same field many times.
+            unique_fields = deduplicate_fields(fields)
+            for i, field in enumerate(unique_fields):
+                for other_field in unique_fields[i + 1 :]:
                     conflict = find_conflict(
                         context,
                         cached_fields_and_fragment_spreads,
@@ -558,6 +561,51 @@ def collect_conflicts_within(
                         conflicts.append(conflict)
 
 
+def deduplicate_fields(fields: list[NodeAndDef]) -> list[NodeAndDef]:
+    """Deduplicate structurally identical fields.
+
+    Fields that are structurally identical (same parent type, field name, arguments,
+    directives and selection set) can never conflict with each other, so only one of
+    them needs to take part in the pairwise conflict comparison.
+    """
+    unique: list[NodeAndDef] = []
+    seen: set[str] = set()
+    for field in fields:
+        key = field_fingerprint(field)
+        if key not in seen:
+            seen.add(key)
+            unique.append(field)
+    return unique
+
+
+def field_fingerprint(field: NodeAndDef) -> str:
+    """Build a fingerprint identifying the structure of a given field.
+
+    Two fields that share a fingerprint are structurally identical and therefore
+    cannot conflict with each other, so only one needs to take part in the pairwise
+    conflict comparison. The fingerprint is derived from normalized AST content
+    rather than node identity, so that repeated occurrences of the same composite
+    field (each of which has a distinct ``SelectionSetNode`` instance) collapse. It
+    mirrors the equivalence relation used by ``find_conflict``: arguments are
+    compared order-independently with normalized values (see ``same_arguments``),
+    and directives are included in a stable order because differing stream
+    directives are treated as a conflict (see ``same_streams``).
+    """
+    parent_type, node, _ = field
+    parts: list[str] = [parent_type.name if parent_type else "", node.name.value]
+    parts.extend(
+        f"{argument.name.value}={stringify_value(argument.value)}"
+        for argument in sorted(node.arguments or (), key=lambda arg: arg.name.value)
+    )
+    parts.extend(
+        print_ast(directive)
+        for directive in sorted(node.directives or (), key=print_ast)
+    )
+    if node.selection_set:
+        parts.append(print_ast(node.selection_set))
+    return "\x00".join(parts)
+
+
 def collect_conflicts_between(
     context: ValidationContext,
     conflicts: list[Conflict],

tests/benchmarks/test_validate_repeated_fields.py

@@ -0,0 +1,24 @@
+import pytest
+
+from graphql import (
+    GraphQLField,
+    GraphQLObjectType,
+    GraphQLSchema,
+    GraphQLString,
+    parse,
+    validate,
+)
+
+schema = GraphQLSchema(
+    query=GraphQLObjectType(
+        name="Query",
+        fields={"hello": GraphQLField(GraphQLString)},
+    )
+)
+
+
+@pytest.mark.parametrize("count", [100, 500, 1000, 2000, 3000])
+def test_validate_many_repeated_fields(benchmark, count):
+    document = parse(f"{{ {'hello ' * count}}}")
+    result = benchmark(lambda: validate(schema, document))
+    assert result == []

tests/validation/test_overlapping_fields_can_be_merged.py

@@ -1,9 +1,12 @@
 from functools import partial
 
+import pytest
+
+from graphql import parse, validate
 from graphql.utilities import build_schema
 from graphql.validation import OverlappingFieldsCanBeMergedRule
 
-from .harness import assert_validation_errors
+from .harness import assert_validation_errors, test_schema
 
 assert_errors = partial(assert_validation_errors, OverlappingFieldsCanBeMergedRule)
 
@@ -1565,6 +1568,71 @@ def does_not_infinite_loop_on_transitively_recursive_fragments():
             """
         )
 
+    def many_repeated_fields_do_not_cause_quadratic_blowup():
+        repeated_fields = "name " * 3000
+        assert_valid(
+            f"""
+            fragment manyRepeatedFields on Dog {{
+              {repeated_fields}
+            }}
+            """
+        )
+
+    def many_repeated_fields_with_conflict_still_detected():
+        repeated_fields = "name " * 100
+        doc = parse(
+            f"""
+            fragment conflictsAmongMany on Dog {{
+              {repeated_fields}
+              name: nickname
+            }}
+            """
+        )
+        errors = validate(test_schema, doc, [OverlappingFieldsCanBeMergedRule])
+        assert errors
+        assert "'name' and 'nickname' are different fields" in errors[0].message
+
+    @pytest.mark.timeout(5)
+    def many_repeated_composite_fields_do_not_cause_quadratic_blowup():
+        # Each occurrence of a composite field has its own SelectionSetNode, so
+        # deduplication must fingerprint the selection set by content, not identity,
+        # otherwise these still trigger quadratic behavior.
+        repeated_fields = "mother { name } " * 3000
+        assert_valid(
+            f"""
+            fragment manyRepeatedCompositeFields on Dog {{
+              {repeated_fields}
+            }}
+            """
+        )
+
+    @pytest.mark.timeout(5)
+    def many_repeated_fields_with_reordered_arguments_do_not_cause_quadratic_blowup():
+        # Fields whose arguments differ only in order are equivalent and must
+        # deduplicate, so the fingerprint has to be argument-order independent.
+        repeated_fields = "isAtLocation(x: 1, y: 2) isAtLocation(y: 2, x: 1) " * 1500
+        assert_valid(
+            f"""
+            fragment reorderedArgs on Dog {{
+              {repeated_fields}
+            }}
+            """
+        )
+
+    def many_repeated_composite_fields_with_conflict_still_detected():
+        repeated_fields = "mother { name } " * 100
+        doc = parse(
+            f"""
+            fragment conflictsAmongManyComposites on Dog {{
+              {repeated_fields}
+              mother {{ name: nickname }}
+            }}
+            """
+        )
+        errors = validate(test_schema, doc, [OverlappingFieldsCanBeMergedRule])
+        assert errors
+        assert "'name' and 'nickname' are different fields" in errors[0].message
+
     def finds_invalid_case_even_with_immediately_recursive_fragment():
         assert_errors(
             """