fix(security): apply adhoc SQL guards in datasource validate_expression

[devin-ai-integration]

SUMMARY

The datasource validate_expression endpoint (POST /api/v1/datasource/{type}/{id}/validate_expression) took an attacker-supplied SQL fragment and executed it against the datasource's analytics DB without the guards the normal adhoc-expression path applies. ExploreMixin._build_validation_query() embeds the raw expression via sa.text()/sa.literal_column() and _execute_validation_query() runs it with con.execute(...) — never calling validate_adhoc_subquery() or sanitize_clause() (unlike _process_sql_expression()). This allowed RLS/subquery bypass (cross-tenant reads), error-based exfiltration via scalar subselects, and — on drivers that permit multiple statements — stacked queries, all with mere datasource READ access.

Fix: route the processed expression through the same guards as the primary adhoc path before it is ever embedded in a query or executed.

In validate_expression, after template processing:

processed_expression = self._process_expression_template(expression, tp)
processed_expression = self._sanitize_validation_expression(processed_expression)  # new

New helper mirrors _process_sql_expression:

def _sanitize_validation_expression(self, expression: str) -> str:
    if not expression:
        return expression
    engine = self.db_engine_spec.engine
    schema = self.schema or self.database.get_default_schema(self.catalog) or ""
    expression = validate_adhoc_subquery(expression, self.database, self.catalog, schema, engine)
    try:
        expression = sanitize_clause(expression, engine)
    except QueryClauseValidationException as ex:
        raise QueryObjectValidationError(ex.message) from ex
    return expression

Effect:

• validate_adhoc_subquery() blocks sub-queries unless ALLOW_ADHOC_SUBQUERY is enabled, and injects RLS predicates into referenced tables when it is — closing the RLS bypass / cross-tenant read and the scalar-subquery error-based exfiltration vector.
• sanitize_clause() re-parses the clause, strips comments, and rejects malformed / multi-statement SQL — closing the comment-terminated stacked-query vector.
• Both raise on violation; the existing except Exception in validate_expression converts them into a normal valid=False validation result, so malformed/blocked input is reported to the user without ever reaching the database.

Note: the _execute_validation_query flow is otherwise unchanged. Two further hardening ideas from the report are intentionally out of scope here to keep the change focused: (1) switching to a parse-only validation that never executes against the live DB / redacting raw driver error strings, and (2) requiring a write/edit-level permission on the endpoint instead of datasource READ. Happy to follow up on either.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A

TESTING INSTRUCTIONS

pytest tests/unit_tests/models/test_validate_expression.py (11 passed). Added regression tests assert that sub-queries and multi-statement/malformed expressions are rejected and never reach _execute_validation_query, while valid column/metric/where/having expressions still pass. Verified with pre-commit run mypy/ruff/ruff-format against the pinned ruff==0.9.7.

Manual: as a user with only READ on a datasource, POST .../validate_expression with {"expression": "id IN (SELECT x FROM other_tenant)", "expression_type": "where"} now returns a validation error ("Custom SQL fields cannot contain sub-queries.") instead of executing the sub-query.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
• Introduces new feature or API
• Removes existing feature or API

Link to Devin session: https://app.devin.ai/sessions/6e4f1ff1081b4e5da71ffa564af7df34
Requested by: @sohil-kshirsagar

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring