feat: implement whitelist

[catalyst17]

TL;DR

Implemented query validation to enhance security and prevent potential SQL injection attacks.

What changed?

• Added a ValidateQuery function in utils.go to check for disallowed patterns and ensure only allowed functions are used in queries.
• Integrated query validation in the ClickHouseConnector methods for executing queries.
• Updated error handling in logs_handlers.go and transactions_handlers.go to potentially use BadRequestError for disallowed functions.

How to test?

1. Try running queries with allowed functions (e.g., sum, count, reinterpretAsUInt256) and ensure they work as expected.
2. Attempt to use disallowed patterns or functions in queries and verify that they are rejected with appropriate error messages.
3. Test different types of queries (SELECT, INSERT, UPDATE, etc.) to confirm that only SELECT queries are allowed.

Why make this change?

This change enhances the security of the application by preventing potential SQL injection attacks and restricting the use of potentially harmful functions or query patterns. It ensures that only safe, pre-approved functions can be used in queries, reducing the risk of unauthorized data access or manipulation.

[linear]

BLOCK-302 Allowed CH functions to be whitelisted to avoid SQL injection

[catalyst17]

• feat: implement whitelist #119 👈
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @catalyst17 and the rest of your teammates on Graphite

[iuwqyir]

Is there any performance impact on this? Can we instead use permissioned db users?