Skip to content

Python: add SQL injection models for the duckdb package #22352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jtabsbm wants to merge 1 commit into
base: main
Choose a base branch
from
+54 −0
Open

Python: add SQL injection models for the duckdb package #22352

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/codeql/reusables/supported-frameworks.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,6 +256,7 @@ and the CodeQL library pack ``codeql/python-all`` (`changelog <https://github.co
cassandra-driver, Database
clickhouse-driver, Database
cx_Oracle, Database
duckdb, Database
hdbcli, Database
mysql-connector, Database
mysql-connector-python, Database
Expand Down
1 change: 1 addition & 0 deletions python/ql/lib/semmle/python/Frameworks.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ private import semmle.python.frameworks.Cx_Oracle
private import semmle.python.frameworks.data.ModelsAsData
private import semmle.python.frameworks.Dill
private import semmle.python.frameworks.Django
private import semmle.python.frameworks.Duckdb
private import semmle.python.frameworks.Fabric
private import semmle.python.frameworks.FastApi
private import semmle.python.frameworks.Flask
Expand Down
44 changes: 44 additions & 0 deletions python/ql/lib/semmle/python/frameworks/Duckdb.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
/**
* Provides classes modeling security-relevant aspects of the `duckdb` PyPI package.
* See
* - https://duckdb.org/docs/stable/clients/python/overview
* - https://pypi.org/project/duckdb/
*/

private import python
private import semmle.python.dataflow.new.DataFlow
private import semmle.python.dataflow.new.RemoteFlowSources
private import semmle.python.Concepts
private import semmle.python.ApiGraphs
private import semmle.python.frameworks.PEP249

/**
* Provides models for the `duckdb` PyPI package.
* See
* - https://duckdb.org/docs/stable/clients/python/overview
* - https://pypi.org/project/duckdb/
*/
private module Duckdb {
/**
* A model of `duckdb` as a module that implements PEP 249, providing ways to execute SQL statements
* against a database.
*/
class DuckdbPEP249 extends PEP249::PEP249ModuleApiNode {
DuckdbPEP249() { this = API::moduleImport("duckdb") }
}

/**
* A call to one of the module level functions `duckdb.sql`, `duckdb.execute` or
* `duckdb.executemany`, all of which immediately execute a SQL statement on the
* default connection.
*
* See https://duckdb.org/docs/stable/clients/python/overview
*/
class ModuleLevelExecuteCall extends SqlExecution::Range, API::CallNode {
ModuleLevelExecuteCall() {
this = API::moduleImport("duckdb").getMember(["sql", "execute", "executemany"]).getACall()
}

override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("query")] }
}
}
8 changes: 8 additions & 0 deletions python/ql/src/change-notes/2026-08-15-duckdb-models.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
## Change notes

Add SQL injection models for the `duckdb` PyPI package. `duckdb` implements the
Python DB-API 2.0 (PEP 249): `duckdb.connect()`, `connection.cursor()`,
`cursor.execute()`, `cursor.executemany()` are now modeled as SQL execution
sinks, and the module-level convenience wrappers `duckdb.sql()`,
`duckdb.execute()` and `duckdb.executemany()` are additionally modeled as
`SqlExecution` calls.
Loading