1

I just found the following function in two RDS PostgreSQL 9.3 DBs:

--
-- Name: exec(text); Type: FUNCTION; Schema: public; Owner: adam
--

CREATE FUNCTION exec(text) RETURNS text
    LANGUAGE plpgsql
    AS $_$ BEGIN EXECUTE $1; RETURN $1; END; $_$;


ALTER FUNCTION public.exec(text) OWNER TO adam;

I am pretty sure I did not write this function, and since exec seems like a security hazard (does it simply execute commands?) It would like to know what is it all about. Searching the method signature didn't help me.

What does this function do?
Is it a security risk of some sort?
Which program/framework might have created it?

4

It's a totally pointless function that executes arbitrary SQL. It isn't SECURITY DEFINER so the only risk I think it can pose is if you allow users to run arbitrary SQL predicates or call arbitrary functions (in which case you're probably already stuffed) but try to block them from running any command they want.

As you guessed, it just executes the SQL input using PL/PgSQL's dynamic SQL facilities.

Oh, it'd also hide the statement text from simple log_statement analysis, auto_explain etc, as they only look at top level statements, not statements run via PL/pgSQL.

Personally I'd drop/rename it, and see what complains.

  • Thanks a lot for the answer. Have you ever encountered a spontaneous creation of this function? – Adam Matan Aug 13 '14 at 14:07
  • No. Something, or someone, created it. If you keep log_statement = 'all' logs far enough back you might be able to find out more. – Craig Ringer Aug 13 '14 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.