Pentest R110: Mass-Assignment-Whitelist auf 7 Katalog-Endpunkten

MEDIUM: PUT /api/stressfrei-emails/:id und 6 weitere Update-
Endpunkte (platform, tariff, contractCategory, cancellationPeriod,
contractDuration, email-providers) reichten req.body ungefiltert
an Prisma. Gleiche Bug-Klasse wie das gefixte M1-Finding, sieben
Stellen mehr. Nachgewiesen via provisionError-Feld ausserhalb des
TS-Types.

Fix: sieben Whitelists + pickXxxUpdate()-Helper in sanitize.ts,
in den jeweiligen Controllern eingehängt. Reuse der bewährten
pick()-Infrastruktur (Customer/User seit Runde 7).

EmailProvider bewusst OHNE stripHtmlFromStrings, weil Passwörter
und API-Keys legitim Sonderzeichen enthalten dürfen.

Doku: SECURITY-HARDENING.md § Runde 110 + docs/todo.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/src/utils/sanitize.ts

@@ -835,3 +835,116 @@ export function pickUserUpdate(body: unknown): Partial<Record<string, unknown>>
 export function pickUserCreate(body: unknown): Partial<Record<string, unknown>> {
   return pick((body as object) || {}, USER_CREATE_FIELDS, { stripHtmlFromStrings: true });
 }
+
+// ==================== KATALOG-/CONFIG-WHITELISTS (Pentest R110) ====================
+// Pentest 2026-07-11 (MEDIUM, R110): sieben Update-Endpunkte reichten
+// `req.body` ungefiltert an Prisma durch – gleiches Muster wie das
+// bekannte M1-Finding (Settings Mass Assignment). Bewiesen war es via
+// `PUT /api/stressfrei-emails/:id`, wo `provisionError` (ausserhalb des
+// TS-Types) durchgeschrieben werden konnte. Die anderen sechs (platform,
+// tariff, contractCategory, cancellationPeriod, contractDuration,
+// email-providers) haben denselben Bug-Pattern. Fix: pro Endpunkt eine
+// enge Feld-Whitelist. Nur die Felder aus dem jeweiligen `updateXxx`-
+// Service-Interface passieren.
+//
+// stripHtml auf String-Werten:
+// - Für Katalog-/Anzeige-Felder (name, description, code, notes …) OK.
+// - Beim EmailProvider bewusst AUS: enthält Passwörter/API-Keys, die
+//   Sonderzeichen (` `, `<`, `>` etc.) enthalten dürfen. Der Endpunkt
+//   ist Admin-only, XSS-Risk minimal – wichtiger, dass Passwort nicht
+//   heimlich mutiliert wird.
+
+const STRESSFREI_EMAIL_UPDATABLE_FIELDS = [
+  'email',
+  'platform',
+  'notes',
+  'isActive',
+] as const;
+
+const PLATFORM_UPDATABLE_FIELDS = [
+  'name',
+  'contactInfo',
+  'isActive',
+] as const;
+
+const TARIFF_UPDATABLE_FIELDS = [
+  'name',
+  'isActive',
+] as const;
+
+const CONTRACT_CATEGORY_UPDATABLE_FIELDS = [
+  'code',
+  'name',
+  'icon',
+  'color',
+  'sortOrder',
+  'isActive',
+] as const;
+
+const CANCELLATION_PERIOD_UPDATABLE_FIELDS = [
+  'code',
+  'description',
+  'isActive',
+] as const;
+
+const CONTRACT_DURATION_UPDATABLE_FIELDS = [
+  'code',
+  'description',
+  'isActive',
+] as const;
+
+const EMAIL_PROVIDER_UPDATABLE_FIELDS = [
+  'name',
+  'type',
+  'apiUrl',
+  'apiKey',
+  'username',
+  'password',
+  'domain',
+  'defaultForwardEmail',
+  'imapServer',
+  'imapPort',
+  'smtpServer',
+  'smtpPort',
+  'imapEncryption',
+  'smtpEncryption',
+  'allowSelfSignedCerts',
+  'systemEmailAddress',
+  'systemEmailPassword',
+  'customerEmailLabel',
+  'isActive',
+  'isDefault',
+] as const;
+
+export function pickStressfreiEmailUpdate(body: unknown): Partial<Record<string, unknown>> {
+  return pick((body as object) || {}, STRESSFREI_EMAIL_UPDATABLE_FIELDS, { stripHtmlFromStrings: true });
+}
+
+export function pickPlatformUpdate(body: unknown): Partial<Record<string, unknown>> {
+  return pick((body as object) || {}, PLATFORM_UPDATABLE_FIELDS, { stripHtmlFromStrings: true });
+}
+
+export function pickTariffUpdate(body: unknown): Partial<Record<string, unknown>> {
+  return pick((body as object) || {}, TARIFF_UPDATABLE_FIELDS, { stripHtmlFromStrings: true });
+}
+
+export function pickContractCategoryUpdate(body: unknown): Partial<Record<string, unknown>> {
+  return pick((body as object) || {}, CONTRACT_CATEGORY_UPDATABLE_FIELDS, { stripHtmlFromStrings: true });
+}
+
+export function pickCancellationPeriodUpdate(body: unknown): Partial<Record<string, unknown>> {
+  return pick((body as object) || {}, CANCELLATION_PERIOD_UPDATABLE_FIELDS, { stripHtmlFromStrings: true });
+}
+
+export function pickContractDurationUpdate(body: unknown): Partial<Record<string, unknown>> {
+  return pick((body as object) || {}, CONTRACT_DURATION_UPDATABLE_FIELDS, { stripHtmlFromStrings: true });
+}
+
+/**
+ * EmailProvider hat Passwörter/API-Keys unter den Feldern; stripHtml
+ * würde Sonderzeichen wie `<`/`>` in einem legitimen Passwort mutilieren.
+ * Whitelist-Filter ja, HTML-Strip nein.
+ */
+export function pickEmailProviderUpdate(body: unknown): Partial<Record<string, unknown>> {
+  return pick((body as object) || {}, EMAIL_PROVIDER_UPDATABLE_FIELDS);
+}