chore: turn SQL templating off by default

UPDATING.md

@@ -23,6 +23,8 @@ assists people when migrating to a new version.
 
 ## Next
 
+* [10887](https://github.com/apache/incubator-superset/pull/11172): Breaking change: SQL templating is turned off be default, to turn it by setting `ENABLE_TEMPLATE_PROCESSING` to True on `DEFAULT_FEATURE_FLAGS`
+
 * [10887](https://github.com/apache/incubator-superset/pull/10887): Breaking change: The custom cache backend changed in order to support the Flask-Caching factory method approach and thus must be registered as a custom type. See [here](https://flask-caching.readthedocs.io/en/latest/#custom-cache-backends) for specifics.
 
 * [10674](https://github.com/apache/incubator-superset/pull/10674): Breaking change: PUBLIC_ROLE_LIKE_GAMMA was removed is favour of the new PUBLIC_ROLE_LIKE so it can be set it whatever role you want.

superset/config.py

@@ -298,6 +298,7 @@ def _try_json_readsha(  # pylint: disable=unused-argument
     "CLIENT_CACHE": False,
     "ENABLE_EXPLORE_JSON_CSRF_PROTECTION": False,
     "ENABLE_DASHBOARD_ETAG_HEADER": False,
+    "ENABLE_TEMPLATE_PROCESSING": False,
     "KV_STORE": False,
     "PRESTO_EXPAND_DATA": False,
     # Exposes API endpoint to compute thumbnails

superset/jinja_context.py

@@ -23,7 +23,7 @@
 from jinja2.sandbox import SandboxedEnvironment
 
 from superset import jinja_base_context
-from superset.extensions import jinja_context_manager
+from superset.extensions import feature_flag_manager, jinja_context_manager
 from superset.utils.core import convert_legacy_filters_into_adhoc, merge_extra_filters
 
 if TYPE_CHECKING:
@@ -247,6 +247,16 @@ def process_template(self, sql: str, **kwargs: Any) -> str:
         return template.render(kwargs)
 
 
+class NoOpTemplateProcessor(
+    BaseTemplateProcessor
+):  # pylint: disable=too-few-public-methods
+    def process_template(self, sql: str, **kwargs: Any) -> str:
+        """
+        Makes processing a template a noop
+        """
+        return sql
+
+
 class PrestoTemplateProcessor(BaseTemplateProcessor):
     """Presto Jinja context
 
@@ -324,7 +334,10 @@ def get_template_processor(
     query: Optional["Query"] = None,
     **kwargs: Any,
 ) -> BaseTemplateProcessor:
-    template_processor = template_processors.get(
-        database.backend, BaseTemplateProcessor
-    )
+    if feature_flag_manager.is_feature_enabled("ENABLE_TEMPLATE_PROCESSING"):
+        template_processor = template_processors.get(
+            database.backend, BaseTemplateProcessor
+        )
+    else:
+        template_processor = NoOpTemplateProcessor
     return template_processor(database=database, table=table, query=query, **kwargs)

tests/superset_test_config.py

@@ -49,7 +49,12 @@
 
 SQL_MAX_ROW = 666
 SQLLAB_CTAS_NO_LIMIT = True  # SQL_MAX_ROW will not take affect for the CTA queries
-FEATURE_FLAGS = {"foo": "bar", "KV_STORE": True, "SHARE_QUERIES_VIA_KV_STORE": True}
+FEATURE_FLAGS = {
+    "foo": "bar",
+    "KV_STORE": True,
+    "SHARE_QUERIES_VIA_KV_STORE": True,
+    "ENABLE_TEMPLATE_PROCESSING": True,
+}
 
 
 def GET_FEATURE_FLAGS_FUNC(ff):