Reasons for unbound result set

Result set limits

In the abstract, an unbounded result set occurs when the caller allows the other system to dictate terms. It’s a failure in handshaking. In any API or protocol, the caller should always indicate how much of a response it’s prepared to accept. TCP does this in the “window” header field. Search engine APIs allow the caller to specify how many results to return and what the starting offset should be. There’s no standard SQL syntax to specify result set limits. ORMs support query parameters that can limit results returned from a query but do not usually limit results when following an association (such as container to contents). Therefore, beware of any relationship that can accumulate unlimited children, such as orders to order lines or user profiles to site visits. Entities that keep an audit trail of changes are also suspect.

Power law

Beware of the way that patterns of relationships can change from QA to production as well. Early social media sites assumed that the number of connections per user would be distributed on something like a bell curve. In fact it’s a power law distribution, which behaves totally differently. If we test with bell-curve distributed relationships, we would never expect to load an entity that has a million times more relationships than the average. But that’s guaranteed to happen with a power law. If we’re handcrafting our own SQLs, use one of these recipes to limit the number of rows to fetch: