feat: support 'chevron' library for templating as jinja alternative

setup.py

@@ -137,6 +137,7 @@ def get_git_sha():
         "teradata": ["sqlalchemy-teradata==0.9.0.dev0"],
         "thumbnails": ["Pillow>=7.0.0, <8.0.0"],
         "vertica": ["sqlalchemy-vertica-python>=0.5.9, < 0.6"],
+        "chevron": ["chevron==0.13.1"],
     },
     python_requires="~=3.6",
     author="Apache Software Foundation",

superset/config.py

@@ -301,7 +301,16 @@ def _try_json_readsha(  # pylint: disable=unused-argument
     # Experimental feature introducing a client (browser) cache
     "CLIENT_CACHE": False,
     "ENABLE_EXPLORE_JSON_CSRF_PROTECTION": False,
+    # -----------------------------------
+    # Template processing section
+    # -----------------------------------
+    # Whether any template processing is enabled at all
     "ENABLE_TEMPLATE_PROCESSING": False,
+    # Use jinja2, most powerful but has potential security pitfalls
+    "JINJA_TEMPLATE_PROCESSING": True,
+    # Use Chevron, a python implementation of mustache.js
+    "CHEVRON_TEMPLATE_PROCESSING": False,
+    # -----------------------------------
     "KV_STORE": False,
     "PRESTO_EXPAND_DATA": False,
     # Exposes API endpoint to compute thumbnails

superset/jinja_context.py

@@ -257,6 +257,15 @@ def process_template(self, sql: str, **kwargs: Any) -> str:
         return sql
 
 
+class ChevronTemplateProcessor(
+    BaseTemplateProcessor
+):  # pylint: disable=too-few-public-methods
+    def process_template(self, sql: str, **kwargs: Any) -> str:
+        import chevron  # late import for optional dependency
+
+        return chevron.render(sql, kwargs)
+
+
 class PrestoTemplateProcessor(BaseTemplateProcessor):
     """Presto Jinja context
 
@@ -334,10 +343,14 @@ def get_template_processor(
     query: Optional["Query"] = None,
     **kwargs: Any,
 ) -> BaseTemplateProcessor:
+    template_processor = None
     if feature_flag_manager.is_feature_enabled("ENABLE_TEMPLATE_PROCESSING"):
-        template_processor = template_processors.get(
-            database.backend, BaseTemplateProcessor
-        )
-    else:
+        if feature_flag_manager.is_feature_enabled("JINJA_TEMPLATE_PROCESSING"):
+            template_processor = template_processors.get(
+                database.backend, BaseTemplateProcessor
+            )
+        elif feature_flag_manager.is_feature_enabled("CHEVRON_TEMPLATE_PROCESSING"):
+            template_processor = ChevronTemplateProcessor
+    if not template_processor:
         template_processor = NoOpTemplateProcessor
     return template_processor(database=database, table=table, query=query, **kwargs)