From 11ac699e2a0684b5fbeb44a9110372d97f90778a Mon Sep 17 00:00:00 2001
From: jtabsbm <317336566@users.noreply.github.com>
Date: Sat, 15 Aug 2026 11:42:58 -0700
Subject: [PATCH] Add SQL injection models for the duckdb Python package

duckdb (~10M downloads/month) implements PEP 249 but had no CodeQL models,
so string-built SQL passed to duckdb.execute()/sql()/executemany() was not
flagged by the SqlInjection query suite. This adds:

- DuckdbPEP249: models duckdb as a PEP 249 module (connect/cursor/
  execute/executemany sinks via the existing PEP249 machinery)
- ModuleLevelExecuteCall: models the module-level duckdb.sql(),
  duckdb.execute() and duckdb.executemany() convenience wrappers as
  SqlExecution calls (getSql from arg 0 or the 'query' keyword)
- Frameworks.qll registration and supported-frameworks docs entry

Pattern follows the merged hdbcli models (PR #19444).

Signed-off-by: jtabsbm <317336566@users.noreply.github.com>
---
 .../codeql/reusables/supported-frameworks.rst |  1 +
 python/ql/lib/semmle/python/Frameworks.qll    |  1 +
 .../lib/semmle/python/frameworks/Duckdb.qll   | 44 +++++++++++++++++++
 .../change-notes/2026-08-15-duckdb-models.md  |  8 ++++
 4 files changed, 54 insertions(+)
 create mode 100644 python/ql/lib/semmle/python/frameworks/Duckdb.qll
 create mode 100644 python/ql/src/change-notes/2026-08-15-duckdb-models.md

diff --git a/docs/codeql/reusables/supported-frameworks.rst b/docs/codeql/reusables/supported-frameworks.rst
index 0552a3495175..45716fd408f7 100644
--- a/docs/codeql/reusables/supported-frameworks.rst
+++ b/docs/codeql/reusables/supported-frameworks.rst
@@ -256,6 +256,7 @@ and the CodeQL library pack ``codeql/python-all`` (`changelog <https://github.co
    cassandra-driver, Database
    clickhouse-driver, Database
    cx_Oracle, Database
+duckdb, Database
    hdbcli, Database
    mysql-connector, Database
    mysql-connector-python, Database
diff --git a/python/ql/lib/semmle/python/Frameworks.qll b/python/ql/lib/semmle/python/Frameworks.qll
index 1c2f0a6e6d41..9ddbea816ecc 100644
--- a/python/ql/lib/semmle/python/Frameworks.qll
+++ b/python/ql/lib/semmle/python/Frameworks.qll
@@ -28,6 +28,7 @@ private import semmle.python.frameworks.Cx_Oracle
 private import semmle.python.frameworks.data.ModelsAsData
 private import semmle.python.frameworks.Dill
 private import semmle.python.frameworks.Django
+private import semmle.python.frameworks.Duckdb
 private import semmle.python.frameworks.Fabric
 private import semmle.python.frameworks.FastApi
 private import semmle.python.frameworks.Flask
diff --git a/python/ql/lib/semmle/python/frameworks/Duckdb.qll b/python/ql/lib/semmle/python/frameworks/Duckdb.qll
new file mode 100644
index 000000000000..b35d95f5175e
--- /dev/null
+++ b/python/ql/lib/semmle/python/frameworks/Duckdb.qll
@@ -0,0 +1,44 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `duckdb` PyPI package.
+ * See
+ * - https://duckdb.org/docs/stable/clients/python/overview
+ * - https://pypi.org/project/duckdb/
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
+private import semmle.python.frameworks.PEP249
+
+/**
+ * Provides models for the `duckdb` PyPI package.
+ * See
+ * - https://duckdb.org/docs/stable/clients/python/overview
+ * - https://pypi.org/project/duckdb/
+ */
+private module Duckdb {
+  /**
+   * A model of `duckdb` as a module that implements PEP 249, providing ways to execute SQL statements
+   * against a database.
+   */
+  class DuckdbPEP249 extends PEP249::PEP249ModuleApiNode {
+    DuckdbPEP249() { this = API::moduleImport("duckdb") }
+  }
+
+  /**
+   * A call to one of the module level functions `duckdb.sql`, `duckdb.execute` or
+   * `duckdb.executemany`, all of which immediately execute a SQL statement on the
+   * default connection.
+   *
+   * See https://duckdb.org/docs/stable/clients/python/overview
+   */
+  class ModuleLevelExecuteCall extends SqlExecution::Range, API::CallNode {
+    ModuleLevelExecuteCall() {
+      this = API::moduleImport("duckdb").getMember(["sql", "execute", "executemany"]).getACall()
+    }
+
+    override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("query")] }
+  }
+}
diff --git a/python/ql/src/change-notes/2026-08-15-duckdb-models.md b/python/ql/src/change-notes/2026-08-15-duckdb-models.md
new file mode 100644
index 000000000000..312c458fa744
--- /dev/null
+++ b/python/ql/src/change-notes/2026-08-15-duckdb-models.md
@@ -0,0 +1,8 @@
+## Change notes
+
+Add SQL injection models for the `duckdb` PyPI package. `duckdb` implements the
+Python DB-API 2.0 (PEP 249): `duckdb.connect()`, `connection.cursor()`,
+`cursor.execute()`, `cursor.executemany()` are now modeled as SQL execution
+sinks, and the module-level convenience wrappers `duckdb.sql()`,
+`duckdb.execute()` and `duckdb.executemany()` are additionally modeled as
+`SqlExecution` calls.