diff --git a/UPDATING.md b/UPDATING.md index 34ac36704..26e4f6fad 100644 --- a/UPDATING.md +++ b/UPDATING.md @@ -23,6 +23,8 @@ assists people when migrating to a new version. ## Next +* [11172](https://github.com/apache/incubator-superset/pull/11172): Breaking change: SQL templating is turned off be default. To turn it on set `ENABLE_TEMPLATE_PROCESSING` to True on `DEFAULT_FEATURE_FLAGS` + * [11155](https://github.com/apache/incubator-superset/pull/11155): The `FAB_UPDATE_PERMS` config parameter is no longer required as the Superset application correctly informs FAB under which context permissions should be updated. * [10887](https://github.com/apache/incubator-superset/pull/10887): Breaking change: The custom cache backend changed in order to support the Flask-Caching factory method approach and thus must be registered as a custom type. See [here](https://flask-caching.readthedocs.io/en/latest/#custom-cache-backends) for specifics. diff --git a/superset/config.py b/superset/config.py index 71c1e99bd..52566af7b 100644 --- a/superset/config.py +++ b/superset/config.py @@ -298,6 +298,7 @@ DEFAULT_FEATURE_FLAGS: Dict[str, bool] = { "CLIENT_CACHE": False, "ENABLE_EXPLORE_JSON_CSRF_PROTECTION": False, "ENABLE_DASHBOARD_ETAG_HEADER": False, + "ENABLE_TEMPLATE_PROCESSING": False, "KV_STORE": False, "PRESTO_EXPAND_DATA": False, # Exposes API endpoint to compute thumbnails diff --git a/superset/jinja_context.py b/superset/jinja_context.py index bc35dbe9c..988aea89b 100644 --- a/superset/jinja_context.py +++ b/superset/jinja_context.py @@ -23,7 +23,7 @@ from flask import g, request from jinja2.sandbox import SandboxedEnvironment from superset import jinja_base_context -from superset.extensions import jinja_context_manager +from superset.extensions import feature_flag_manager, jinja_context_manager from superset.utils.core import convert_legacy_filters_into_adhoc, merge_extra_filters if TYPE_CHECKING: @@ -247,6 +247,16 @@ class BaseTemplateProcessor: # pylint: disable=too-few-public-methods return template.render(kwargs) +class NoOpTemplateProcessor( + BaseTemplateProcessor +): # pylint: disable=too-few-public-methods + def process_template(self, sql: str, **kwargs: Any) -> str: + """ + Makes processing a template a noop + """ + return sql + + class PrestoTemplateProcessor(BaseTemplateProcessor): """Presto Jinja context @@ -324,7 +334,10 @@ def get_template_processor( query: Optional["Query"] = None, **kwargs: Any, ) -> BaseTemplateProcessor: - template_processor = template_processors.get( - database.backend, BaseTemplateProcessor - ) + if feature_flag_manager.is_feature_enabled("ENABLE_TEMPLATE_PROCESSING"): + template_processor = template_processors.get( + database.backend, BaseTemplateProcessor + ) + else: + template_processor = NoOpTemplateProcessor return template_processor(database=database, table=table, query=query, **kwargs) diff --git a/tests/superset_test_config.py b/tests/superset_test_config.py index 513d3d90c..8d03115bd 100644 --- a/tests/superset_test_config.py +++ b/tests/superset_test_config.py @@ -49,7 +49,12 @@ HIVE_POLL_INTERVAL = 0.1 SQL_MAX_ROW = 666 SQLLAB_CTAS_NO_LIMIT = True # SQL_MAX_ROW will not take affect for the CTA queries -FEATURE_FLAGS = {"foo": "bar", "KV_STORE": True, "SHARE_QUERIES_VIA_KV_STORE": True} +FEATURE_FLAGS = { + "foo": "bar", + "KV_STORE": True, + "SHARE_QUERIES_VIA_KV_STORE": True, + "ENABLE_TEMPLATE_PROCESSING": True, +} def GET_FEATURE_FLAGS_FUNC(ff):