Medium

Mutable search_path on public.refresh_usage_totals()

Affected:: public.refresh_usage_totals()
Category:: Functions
Confidence:: high
First detected:: 2026-08-12 11:04Z
Last verified:: 2026-08-16 09:41Z

Summary

public.refresh_usage_totals() executes with owner privileges but resolves objects through the caller's search_path.

Why this matters

A role able to create objects in a schema earlier in the search path can shadow a referenced table or operator and have their definition executed with elevated privileges.

Evidence

Object: public.refresh_usage_totals()
Function security: SECURITY DEFINER
proconfig search_path: (not set)
Executable by: service_role

Facts above were derived by the scanner from database metadata. No model output is involved in the verdict.

Technical details

pg_proc.prosecdef is true and pg_proc.proconfig contains no search_path entry.

recommended remediation

Unlock the full security analysis

Buy full analysis

Pin search_path on the function.

Current

CREATE OR REPLACE FUNCTION public.refresh_usage_totals()
...
SECURITY DEFINER
AS $$ ... $$;

Proposed

ALTER FUNCTION public.refresh_usage_totals()
  SET search_path = public, pg_temp;

Expected security effect

Object resolution pinned
Schema shadowing path removed

Compatibility risk

low

Unqualified references to objects outside public will need schema qualification.

DBX never applies SQL to your database.