Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I just found the following function in two RDS PostgreSQL 9.3 DBs:

--
-- Name: exec(text); Type: FUNCTION; Schema: public; Owner: adam
--

CREATE FUNCTION exec(text) RETURNS text
    LANGUAGE plpgsql
    AS $_$ BEGIN EXECUTE $1; RETURN $1; END; $_$;


ALTER FUNCTION public.exec(text) OWNER TO adam;

I am pretty sure I did not write this function, and since exec seems like a security hazard (does it simply execute commands?) It would like to know what is it all about. Searching the method signature didn't help me.

What does this function do?
Is it a security risk of some sort?
Which program/framework might have created it?

share|improve this question
    
"What does this function do?" - postgresql.org/docs/current/static/… –  a_horse_with_no_name Aug 13 at 11:40
    
@a_horse_with_no_name thanks. –  Adam Matan Aug 13 at 14:07

1 Answer 1

up vote 4 down vote accepted

It's a totally pointless function that executes arbitrary SQL. It isn't SECURITY DEFINER so the only risk I think it can pose is if you allow users to run arbitrary SQL predicates or call arbitrary functions (in which case you're probably already stuffed) but try to block them from running any command they want.

As you guessed, it just executes the SQL input using PL/PgSQL's dynamic SQL facilities.

Oh, it'd also hide the statement text from simple log_statement analysis, auto_explain etc, as they only look at top level statements, not statements run via PL/pgSQL.

Personally I'd drop/rename it, and see what complains.

share|improve this answer
    
Thanks a lot for the answer. Have you ever encountered a spontaneous creation of this function? –  Adam Matan Aug 13 at 14:07
    
No. Something, or someone, created it. If you keep log_statement = 'all' logs far enough back you might be able to find out more. –  Craig Ringer Aug 13 at 15:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.