A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist.

Bug description Hello, I'm using Superset in 5.0.0 and can't create charts with Apache Pinot as datasource anymore. Looks like the chart tool isn't using the correct SQLGLOT? The charts are using t ...