Python: Add support of clickhouse-driver package

[japroc]

Query

Link to pull request with your CodeQL query:

Relevant PR: github/codeql#5889

CVE ID(s)

List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the GitHub Advisory Database.

• no CVEs

Report

Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.

The idea of this PR is to improve default SQLInjection query by adding ClickHouseDriver.qll module with describes clickhouse-driver PyPI package. This module hsa self Client with several methods to execute query. Also clickhouse-driver has a PEP249 interface.

When this module will be moved from experimental folder to standart library, it would automatically improve existing Sqlnjection.ql query. But for now, for a demonstration, i created a separate query which imports experimental module and repeats standart query. I also added python snippet for clickhouse-driver usage and qhelp which describes different cases from that example code.

• Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing
  Possibly i will share my experience on the upcoming conference on Defense Talk about SAST.

Result(s)

Provide at least one useful result found by your query, on some revision of a real project.

• There are some findings on not active projects like: Beyondzhangxin/DBcenter 54c3e31 21 alerts, eteresh/metric_constructor 6c0e4c6 4 alerts, likelib-analytics/api41bf974 7 alerts (For them i did a PR.
• There is a unexploitable finding in tac0x2a/nayco 1007a6c 7 alerts. These alerts are unexploitable because they use strange type of escaping character `. They quote database names with this symbol, so i was unable to break this one and exploit. There are exploitable findings on revision 3a0f9d93f678372a845a9ea19a777aa1c602840e

Going to search for some explotable findings on not latest revisions of projects.

[ghsecuritylab]

Your submission is now in status SecLab review.

For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

[ghsecuritylab]

Your submission is now in status CodeQL review.

For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > FP Check > CodeQL review > SecLab finalize > Pay > Closed

[ghsecuritylab]

Your submission is now in status SecLab finalize.

For information, the evaluation workflow is the following:
SecLab review > FP Check > CodeQL review > SecLab finalize > Pay > Closed

[ghsecuritylab]

Your submission is now in status Pay.

For information, the evaluation workflow is the following:
SecLab review > FP Check > CodeQL review > SecLab finalize > Pay > Closed

[xcorail]

Created Hackerone report 1217143 for bounty 309567 : [365] Python: Add support of clickhouse-driver package

[ghsecuritylab]

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
SecLab review > FP Check > CodeQL review > SecLab finalize > Pay > Closed

[japroc]

Thank you!