fix: allow subquery in ad-hoc SQL

[lilykuang]

SUMMARY

RLS only works for basic case. The chart/data api allows several controls (ad-hoc metrics, ad-hoc filters) where users can write any SQL in these fields, including subqueries. Any subqueries, or nested subqueries, do not currently have RLS rules applied to them and thus can leak data users shouldn’t have access to.

This PR allows most of ad-hoc sql but reject adhoc contains subqueries or nested subqueries. It is using helper #19055. The feature flag ALLOW_ADHOC_SUBQUERY is set to False by default.
We will have a follow up implementation to add RLS rules to subqueries and nested subqueries.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[codecov]

Codecov Report

Merging #19242 (8163c42) into master (51061f0) will decrease coverage by 0.16%.
The diff coverage is 78.26%.

❗ Current head 8163c42 differs from pull request most recent head 16f5f3d. Consider uploading reports for the commit 16f5f3d to get more accurate results

@@            Coverage Diff             @@
##           master   #19242      +/-   ##
==========================================
- Coverage   66.76%   66.59%   -0.17%     
==========================================
  Files        1670     1670              
  Lines       64392    64413      +21     
  Branches     6499     6499              
==========================================
- Hits        42991    42899      -92     
- Misses      19718    19831     +113     
  Partials     1683     1683              

Flag	Coverage Δ
hive	?
mysql	81.96% <78.26%> (-0.01%)	⬇️
postgres	82.01% <78.26%> (-0.01%)	⬇️
presto	?
python	82.10% <78.26%> (-0.35%)	⬇️
sqlite	81.76% <78.26%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
superset/config.py	91.82% <ø> (ø)
superset/views/sql_lab.py	59.33% <20.00%> (-1.36%)	⬇️
superset/connectors/sqla/utils.py	91.66% <90.00%> (-0.50%)	⬇️
superset/connectors/sqla/models.py	88.94% <100.00%> (-1.18%)	⬇️
superset/errors.py	94.44% <100.00%> (+0.07%)	⬆️
superset/models/sql_lab.py	91.55% <100.00%> (ø)
superset/db_engines/hive.py	0.00% <0.00%> (-85.19%)	⬇️
superset/db_engine_specs/hive.py	70.00% <0.00%> (-15.77%)	⬇️
superset/db_engine_specs/presto.py	83.47% <0.00%> (-5.65%)	⬇️
... and 3 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 51061f0...16f5f3d. Read the comment docs.

[betodealmeida]

This looks great! I was confused by the behavior of allow_adhoc_subquery, so I left a suggestion on how to make it easier to understand.

[betodealmeida]

Lily, I tried to clarify my comment on the function. While the current approach works, having a boolean function that never returns False makes it harder to reason about the code, so my suggestion is to have it return None or raise an exception.

[betodealmeida]

Thanks for changing the function, Lily!

[sadpandajoe]

🏷️ preset:2022.11