Add SQL injection models for the duckdb Python package

duckdb (~10M downloads/month) implements PEP 249 but had no CodeQL models,
so string-built SQL passed to duckdb.execute()/sql()/executemany() was not
flagged by the SqlInjection query suite. This adds:

- DuckdbPEP249: models duckdb as a PEP 249 module (connect/cursor/
  execute/executemany sinks via the existing PEP249 machinery)
- ModuleLevelExecuteCall: models the module-level duckdb.sql(),
  duckdb.execute() and duckdb.executemany() convenience wrappers as
  SqlExecution calls (getSql from arg 0 or the 'query' keyword)
- Frameworks.qll registration and supported-frameworks docs entry

Pattern follows the merged hdbcli models (PR #19444).

Signed-off-by: jtabsbm <317336566@users.noreply.github.com>

Author: jtabsbm

docs/codeql/reusables/supported-frameworks.rst

@@ -256,6 +256,7 @@ and the CodeQL library pack ``codeql/python-all`` (`changelog <https://github.co
    cassandra-driver, Database
    clickhouse-driver, Database
    cx_Oracle, Database
+duckdb, Database
    hdbcli, Database
    mysql-connector, Database
    mysql-connector-python, Database

python/ql/lib/semmle/python/Frameworks.qll

@@ -28,6 +28,7 @@ private import semmle.python.frameworks.Cx_Oracle
 private import semmle.python.frameworks.data.ModelsAsData
 private import semmle.python.frameworks.Dill
 private import semmle.python.frameworks.Django
+private import semmle.python.frameworks.Duckdb
 private import semmle.python.frameworks.Fabric
 private import semmle.python.frameworks.FastApi
 private import semmle.python.frameworks.Flask

python/ql/lib/semmle/python/frameworks/Duckdb.qll

@@ -0,0 +1,44 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `duckdb` PyPI package.
+ * See
+ * - https://duckdb.org/docs/stable/clients/python/overview
+ * - https://pypi.org/project/duckdb/
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
+private import semmle.python.frameworks.PEP249
+
+/**
+ * Provides models for the `duckdb` PyPI package.
+ * See
+ * - https://duckdb.org/docs/stable/clients/python/overview
+ * - https://pypi.org/project/duckdb/
+ */
+private module Duckdb {
+  /**
+   * A model of `duckdb` as a module that implements PEP 249, providing ways to execute SQL statements
+   * against a database.
+   */
+  class DuckdbPEP249 extends PEP249::PEP249ModuleApiNode {
+    DuckdbPEP249() { this = API::moduleImport("duckdb") }
+  }
+
+  /**
+   * A call to one of the module level functions `duckdb.sql`, `duckdb.execute` or
+   * `duckdb.executemany`, all of which immediately execute a SQL statement on the
+   * default connection.
+   *
+   * See https://duckdb.org/docs/stable/clients/python/overview
+   */
+  class ModuleLevelExecuteCall extends SqlExecution::Range, API::CallNode {
+    ModuleLevelExecuteCall() {
+      this = API::moduleImport("duckdb").getMember(["sql", "execute", "executemany"]).getACall()
+    }
+
+    override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("query")] }
+  }
+}

python/ql/src/change-notes/2026-08-15-duckdb-models.md

@@ -0,0 +1,8 @@
+## Change notes
+
+Add SQL injection models for the `duckdb` PyPI package. `duckdb` implements the
+Python DB-API 2.0 (PEP 249): `duckdb.connect()`, `connection.cursor()`,
+`cursor.execute()`, `cursor.executemany()` are now modeled as SQL execution
+sinks, and the module-level convenience wrappers `duckdb.sql()`,
+`duckdb.execute()` and `duckdb.executemany()` are additionally modeled as
+`SqlExecution` calls.