Python: add SQL injection models for the duckdb package - #22352
Open
jtabsbm wants to merge 1 commit into
Open
Conversation
duckdb (~10M downloads/month) implements PEP 249 but had no CodeQL models, so string-built SQL passed to duckdb.execute()/sql()/executemany() was not flagged by the SqlInjection query suite. This adds: - DuckdbPEP249: models duckdb as a PEP 249 module (connect/cursor/ execute/executemany sinks via the existing PEP249 machinery) - ModuleLevelExecuteCall: models the module-level duckdb.sql(), duckdb.execute() and duckdb.executemany() convenience wrappers as SqlExecution calls (getSql from arg 0 or the 'query' keyword) - Frameworks.qll registration and supported-frameworks docs entry Pattern follows the merged hdbcli models (PR github#19444). Signed-off-by: jtabsbm <317336566@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds CodeQL data-flow models for the
duckdbPython package (~10M downloads/month).duckdbimplements the Python DB-API 2.0 (PEP 249), but had no models in this repo, so string-built SQL passed toduckdbexecution APIs was not flagged by theSqlInjectionquery suite.Specifically:
DuckdbPEP249modelsduckdbas a PEP 249 module, givingduckdb.connect(),connection.cursor(),cursor.execute()andcursor.executemany()the standard SQL-execution sink models via the existing PEP 249 machinery (plus the fetch* threat-model sources).ModuleLevelExecuteCalladditionally models the module-level convenience wrappersduckdb.sql(),duckdb.execute()andduckdb.executemany()asSqlExecutioncalls, withgetSql()bound to positional argument 0 or thequerykeyword.Frameworks.qlland addsduckdb, Databaseto the supported frameworks docs.The modeling pattern follows the merged
hdbclimodels from #19444.Testing
Checklist:
.qllchanges are insemmle/python/frameworks/