Security-Hardening Runde 3: JWT, trust-proxy, weitere IDORs, Attachment-Härtung

- JWT-Algorithmus fest auf HS256 (Defense-in-Depth gegen alg-confusion)
- app.set('trust proxy', 1) – Rate-Limiter wirkt jetzt auch hinter Reverse-Proxy
- IDOR-Fix: Invoice-ECD-Endpoints + PDF-Template-Generierung (canAccessContract/ECD)
- Email-Anhang-Download: Content-Type-Safelist, SVG nie inline, nosniff, Filename-CRLF-Sanitize
- Provider/Tariff-GET-Routen: requirePermission('providers:read') (Portal-Kunden raus)
- SMTP-Header-Injection zentral in sendEmail blockiert (schützt alle Caller)
- bcrypt-Cost 10 → 12 (OWASP 2026)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/services/smtpService.ts

@@ -49,6 +49,16 @@ export interface EmailLogContext {
   triggeredBy?: string;    // User-Email
 }
 
+// Security: zentrale CRLF-Prüfung gegen SMTP-Header-Injection.
+// Alle Felder, die als Header ausgehen (to/cc/subject/replyTo/references/from),
+// werden hier geprüft – egal ob der Caller aus cachedEmail, birthday, gdpr,
+// consent-public oder auth kommt.
+function containsCRLF(value: unknown): boolean {
+  if (typeof value === 'string') return /[\r\n]/.test(value);
+  if (Array.isArray(value)) return value.some(containsCRLF);
+  return false;
+}
+
 // E-Mail senden
 export async function sendEmail(
   credentials: SmtpCredentials,
@@ -56,6 +66,21 @@ export async function sendEmail(
   params: SendEmailParams,
   logContext?: EmailLogContext
 ): Promise<SendEmailResult> {
+  // Header-Injection-Guard (defensiv: Absender, Empfänger, Subject)
+  if (
+    containsCRLF(fromAddress) ||
+    containsCRLF(params.to) ||
+    containsCRLF(params.cc) ||
+    containsCRLF(params.subject) ||
+    containsCRLF(params.inReplyTo) ||
+    containsCRLF(params.references)
+  ) {
+    return {
+      success: false,
+      error: 'Ungültige Zeichen in E-Mail-Header-Feldern (CRLF nicht erlaubt)',
+    };
+  }
+
   // Verschlüsselungs-Einstellungen basierend auf Modus
   const encryption = credentials.encryption ?? 'SSL';
   const rejectUnauthorized = !credentials.allowSelfSignedCerts;