Hacker-Software/opencrm
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Pentest R110: Mass-Assignment-Whitelist auf 7 Katalog-Endpunkten

Browse Source 
MEDIUM: PUT /api/stressfrei-emails/:id und 6 weitere Update-
Endpunkte (platform, tariff, contractCategory, cancellationPeriod,
contractDuration, email-providers) reichten req.body ungefiltert
an Prisma. Gleiche Bug-Klasse wie das gefixte M1-Finding, sieben
Stellen mehr. Nachgewiesen via provisionError-Feld ausserhalb des
TS-Types.

Fix: sieben Whitelists + pickXxxUpdate()-Helper in sanitize.ts,
in den jeweiligen Controllern eingehängt. Reuse der bewährten
pick()-Infrastruktur (Customer/User seit Runde 7).

EmailProvider bewusst OHNE stripHtmlFromStrings, weil Passwörter
und API-Keys legitim Sonderzeichen enthalten dürfen.

Doku: SECURITY-HARDENING.md § Runde 110 + docs/todo.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
duffyduck
2026-07-11 16:16:49 +02:00
co-authored by Claude Opus 4.7
parent dc7dcfb5f3
commit da3ae282fc
10 changed files with 185 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/controllers/cancellation-period.controller.ts
+3 -1
View File
@@ -2,6 +2,7 @@ import { Request, Response } from 'express';
import * as cancellationPeriodService from '../services/cancellation-period.service.js';
import { logChange } from '../services/audit.service.js';
import { ApiResponse } from '../types/index.js';
import { pickCancellationPeriodUpdate } from '../utils/sanitize.js';
export async function getCancellationPeriods(req: Request, res: Response): Promise<void> {
try {
@@ -54,7 +55,8 @@ export async function createCancellationPeriod(req: Request, res: Response): Pro
export async function updateCancellationPeriod(req: Request, res: Response): Promise<void> {
try {
const period = await cancellationPeriodService.updateCancellationPeriod(parseInt(req.params.id), req.body);
// Pentest R110: Mass-Assignment-Whitelist.
const period = await cancellationPeriodService.updateCancellationPeriod(parseInt(req.params.id), pickCancellationPeriodUpdate(req.body));
await logChange({
req, action: 'UPDATE', resourceType: 'CancellationPeriod',
resourceId: period.id.toString(),
backend/src/controllers/contract-duration.controller.ts
+3 -1
View File
@@ -2,6 +2,7 @@ import { Request, Response } from 'express';
import * as contractDurationService from '../services/contract-duration.service.js';
import { logChange } from '../services/audit.service.js';
import { ApiResponse } from '../types/index.js';
import { pickContractDurationUpdate } from '../utils/sanitize.js';
export async function getContractDurations(req: Request, res: Response): Promise<void> {
try {
@@ -54,7 +55,8 @@ export async function createContractDuration(req: Request, res: Response): Promi
export async function updateContractDuration(req: Request, res: Response): Promise<void> {
try {
const duration = await contractDurationService.updateContractDuration(parseInt(req.params.id), req.body);
// Pentest R110: Mass-Assignment-Whitelist.
const duration = await contractDurationService.updateContractDuration(parseInt(req.params.id), pickContractDurationUpdate(req.body));
await logChange({
req, action: 'UPDATE', resourceType: 'ContractDuration',
resourceId: duration.id.toString(),
backend/src/controllers/contractCategory.controller.ts
+3 -1
View File
@@ -2,6 +2,7 @@ import { Request, Response } from 'express';
import * as contractCategoryService from '../services/contractCategory.service.js';
import { logChange } from '../services/audit.service.js';
import { ApiResponse } from '../types/index.js';
import { pickContractCategoryUpdate } from '../utils/sanitize.js';
export async function getContractCategories(req: Request, res: Response): Promise<void> {
try {
@@ -54,7 +55,8 @@ export async function createContractCategory(req: Request, res: Response): Promi
export async function updateContractCategory(req: Request, res: Response): Promise<void> {
try {
const category = await contractCategoryService.updateContractCategory(parseInt(req.params.id), req.body);
// Pentest R110: Mass-Assignment-Whitelist.
const category = await contractCategoryService.updateContractCategory(parseInt(req.params.id), pickContractCategoryUpdate(req.body));
await logChange({
req, action: 'UPDATE', resourceType: 'ContractCategory',
resourceId: category.id.toString(),
backend/src/controllers/emailProvider.controller.ts
+4 -1
View File
@@ -10,6 +10,7 @@ import { decrypt } from '../utils/encryption.js';
import { assertAllowedHost, safeResolveHost } from '../utils/ssrfGuard.js';
import { emit as emitSecurityEvent, contextFromRequest } from '../services/securityMonitor.service.js';
import { PrismaClient } from '@prisma/client';
import { pickEmailProviderUpdate } from '../utils/sanitize.js';
const prisma = new PrismaClient();
@@ -69,7 +70,9 @@ export async function createProviderConfig(req: Request, res: Response): Promise
export async function updateProviderConfig(req: Request, res: Response): Promise<void> {
try {
const id = parseInt(req.params.id);
const config = await emailProviderService.updateProviderConfig(id, req.body);
// Pentest R110: Mass-Assignment-Whitelist. Kein stripHtml, weil das
// Payload Passwörter/API-Keys enthalten kann.
const config = await emailProviderService.updateProviderConfig(id, pickEmailProviderUpdate(req.body) as any);
await logChange({
req, action: 'UPDATE', resourceType: 'EmailProviderConfig',
resourceId: id.toString(),
backend/src/controllers/platform.controller.ts
+3 -1
View File
@@ -2,6 +2,7 @@ import { Request, Response } from 'express';
import * as platformService from '../services/platform.service.js';
import { logChange } from '../services/audit.service.js';
import { ApiResponse } from '../types/index.js';
import { pickPlatformUpdate } from '../utils/sanitize.js';
export async function getPlatforms(req: Request, res: Response): Promise<void> {
try {
@@ -54,7 +55,8 @@ export async function createPlatform(req: Request, res: Response): Promise<void>
export async function updatePlatform(req: Request, res: Response): Promise<void> {
try {
const platform = await platformService.updatePlatform(parseInt(req.params.id), req.body);
// Pentest R110: Mass-Assignment-Whitelist (nur name/contactInfo/isActive).
const platform = await platformService.updatePlatform(parseInt(req.params.id), pickPlatformUpdate(req.body));
await logChange({
req, action: 'UPDATE', resourceType: 'Platform',
resourceId: platform.id.toString(),
backend/src/controllers/stressfreiEmail.controller.ts
+7 -1
View File
@@ -4,6 +4,7 @@ import { logChange } from '../services/audit.service.js';
import { ApiResponse, AuthRequest } from '../types/index.js';
import { canAccessCustomer, canAccessStressfreiEmail } from '../utils/accessControl.js';
import { ApiError } from '../utils/apiError.js';
import { pickStressfreiEmailUpdate } from '../utils/sanitize.js';
// Pentest 71.3 (INFO): `parseInt(...)` ohne NaN-Check gab bei
// `/stressfrei-emails/abc/...` einen generischen 500 zurück.
@@ -105,7 +106,12 @@ export async function updateEmail(req: AuthRequest, res: Response): Promise<void
const emailId = requireIdParam(req, res, 'id');
if (emailId === null) return;
if (!(await canAccessStressfreiEmail(req, res, emailId))) return;
const email = await stressfreiEmailService.updateEmail(emailId, req.body);
// Pentest R110 (MEDIUM, 2026-07-11): Mass-Assignment ohne Whitelist.
// `req.body` reichte ungefiltert an Prisma – Angreifer konnte
// beliebige Model-Felder (`provisionError`, `isProvisioned`,
// `emailPasswordEncrypted` …) durch. Jetzt strikt auf die vier
// vom Service akzeptierten Felder gefiltert.
const email = await stressfreiEmailService.updateEmail(emailId, pickStressfreiEmailUpdate(req.body));
await logChange({
req, action: 'UPDATE', resourceType: 'StressfreiEmail',
resourceId: email.id.toString(),
backend/src/controllers/tariff.controller.ts
+3 -1
View File
@@ -2,6 +2,7 @@ import { Request, Response } from 'express';
import * as tariffService from '../services/tariff.service.js';
import { logChange } from '../services/audit.service.js';
import { ApiResponse } from '../types/index.js';
import { pickTariffUpdate } from '../utils/sanitize.js';
export async function getTariffs(req: Request, res: Response): Promise<void> {
try {
@@ -56,7 +57,8 @@ export async function createTariff(req: Request, res: Response): Promise<void> {
export async function updateTariff(req: Request, res: Response): Promise<void> {
try {
const tariff = await tariffService.updateTariff(parseInt(req.params.id), req.body);
// Pentest R110: Mass-Assignment-Whitelist (nur name/isActive).
const tariff = await tariffService.updateTariff(parseInt(req.params.id), pickTariffUpdate(req.body));
await logChange({
req, action: 'UPDATE', resourceType: 'Tariff',
resourceId: tariff.id.toString(),