Mitigate issue #5923 (Prompt injection -> SQL injection in SQLChain)

[boazwasserman]

Add validation controls to the SQL chain to mitigate SQL injection issues.
Using sqlfluff to perform static analysis:

1. Disallow non select statement (INSERT, DROP)
2. Disallow wildcard select statement

Some dialects that are supported by langchain are not supported by sqlfluff. It is possible to disallow usage of such dialects as well.

Also fixed the SQL integration tests which were not working as expected

Fixes #5923

BTW, looks like there is a huge diff on poetry.lock which doesn't look OK to me, would appreciate any advice on how to resovle it (I was following the instructions found here https://github.com/hwchase17/langchain/blob/master/.github/CONTRIBUTING.md)

Who can review?

@hwchase17

[vercel]

@boazwasserman is attempting to deploy a commit to the LangChain Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Ignored Deployment

Name	Status	Preview	Comments	Updated (UTC)
langchain	⬜️ Ignored (Inspect)			Jun 21, 2023 6:58am

[harsha89vyas]

@boazwasserman @hwchase17 any update on this PR? This is required to resolve a flagged mend vulnerability.

[obi1kenobi]

We ended up resolving this issue in a different way, and langchain versions since 0.0.247 onward are not vulnerable in this way.

Unfortunately, this fact was not picked up by the various vulnerability databases, so we're in the process of following up on that.

The full details of our fix are here but TL;DR:

• We removed the offending code from langchain entirely.
• We moved the code to langchain-experimental, which is a package intended for prototyping new ideas before all the edge cases are resolved or any APIs are stabilized. There, we're adding prominent security warnings reminding users to limit the database permissions they grant the credentials used with the chain: Add security warning to experimental SQLDatabaseChain class. #9867

Thanks for your help and for your patience as we polish up our processes for making our security fixes visible to the security tools used in the community.