chore: turn SQL templating off by default (#11172)

* feat: possible to turn off SQL templating

* turn SQL templating off by default

* Update UPDATING.md

Co-authored-by: Ville Brofeldt <33317356+villebro@users.noreply.github.com>

* fix missing PR number

* fix missing PR number

Co-authored-by: Ville Brofeldt <33317356+villebro@users.noreply.github.com>

UPDATING.md

@@ -23,6 +23,8 @@ assists people when migrating to a new version.
 
 ## Next
 
+* [11172](https://github.com/apache/incubator-superset/pull/11172): Breaking change: SQL templating is turned off be default. To turn it on set `ENABLE_TEMPLATE_PROCESSING` to True on `DEFAULT_FEATURE_FLAGS`
+
 * [11155](https://github.com/apache/incubator-superset/pull/11155): The `FAB_UPDATE_PERMS` config parameter is no longer required as the Superset application correctly informs FAB under which context permissions should be updated.
 
 * [10887](https://github.com/apache/incubator-superset/pull/10887): Breaking change: The custom cache backend changed in order to support the Flask-Caching factory method approach and thus must be registered as a custom type. See [here](https://flask-caching.readthedocs.io/en/latest/#custom-cache-backends) for specifics.

superset/config.py

@@ -298,6 +298,7 @@ DEFAULT_FEATURE_FLAGS: Dict[str, bool] = {
     "CLIENT_CACHE": False,
     "ENABLE_EXPLORE_JSON_CSRF_PROTECTION": False,
     "ENABLE_DASHBOARD_ETAG_HEADER": False,
+    "ENABLE_TEMPLATE_PROCESSING": False,
     "KV_STORE": False,
     "PRESTO_EXPAND_DATA": False,
     # Exposes API endpoint to compute thumbnails

superset/jinja_context.py

@@ -23,7 +23,7 @@ from flask import g, request
 from jinja2.sandbox import SandboxedEnvironment
 
 from superset import jinja_base_context
-from superset.extensions import jinja_context_manager
+from superset.extensions import feature_flag_manager, jinja_context_manager
 from superset.utils.core import convert_legacy_filters_into_adhoc, merge_extra_filters
 
 if TYPE_CHECKING:
@@ -247,6 +247,16 @@ class BaseTemplateProcessor:  # pylint: disable=too-few-public-methods
         return template.render(kwargs)
 
 
+class NoOpTemplateProcessor(
+    BaseTemplateProcessor
+):  # pylint: disable=too-few-public-methods
+    def process_template(self, sql: str, **kwargs: Any) -> str:
+        """
+        Makes processing a template a noop
+        """
+        return sql
+
+
 class PrestoTemplateProcessor(BaseTemplateProcessor):
     """Presto Jinja context
 
@@ -324,7 +334,10 @@ def get_template_processor(
     query: Optional["Query"] = None,
     **kwargs: Any,
 ) -> BaseTemplateProcessor:
-    template_processor = template_processors.get(
-        database.backend, BaseTemplateProcessor
-    )
+    if feature_flag_manager.is_feature_enabled("ENABLE_TEMPLATE_PROCESSING"):
+        template_processor = template_processors.get(
+            database.backend, BaseTemplateProcessor
+        )
+    else:
+        template_processor = NoOpTemplateProcessor
     return template_processor(database=database, table=table, query=query, **kwargs)

tests/superset_test_config.py

@@ -49,7 +49,12 @@ HIVE_POLL_INTERVAL = 0.1
 
 SQL_MAX_ROW = 666
 SQLLAB_CTAS_NO_LIMIT = True  # SQL_MAX_ROW will not take affect for the CTA queries
-FEATURE_FLAGS = {"foo": "bar", "KV_STORE": True, "SHARE_QUERIES_VIA_KV_STORE": True}
+FEATURE_FLAGS = {
+    "foo": "bar",
+    "KV_STORE": True,
+    "SHARE_QUERIES_VIA_KV_STORE": True,
+    "ENABLE_TEMPLATE_PROCESSING": True,
+}
 
 
 def GET_FEATURE_FLAGS_FUNC(ff):