security(smime): fork upstream plugin and fix two audit findings

S-01 audited bulwarkmail/plugins/smime @ 91085a3 (2,935 lines). Nine
findings, two HIGH. No backdoor and no exfiltration path anywhere in the
bundle — the problems are trust-model and input-validation gaps. Full
report in vnc/audits/SMIME-PLUGIN-AUDIT-2026-08-04.md.

Fork is source-only. The upstream smime.zip is a 1.77 MB prebuilt bundle
whose manifest reads 1.0.1 while the source reads 1.0.2, so auditing
src/ would not audit what that zip installs. We build from source.

Finding 1 (HIGH) — certificate substitution. maybeAutoImportSigner gated
on signatureValid alone, but smimeVerify runs checkChain:false, so that
only proves "signed by whoever holds this key", not that the claimed
identity is real. Self-sign a cert asserting victim@example.com, send one
signed message, and it was stored as the encryption target for that
address — the user's next Encrypt to the victim went to the attacker.
Now requires signerEmailMatch === true and !selfSigned. Both values were
already computed and displayed as untrusted in the banner; only the
import path ignored them. Tests for `true` explicitly so an undefined
match (missing From header) fails closed.

Finding 3 (MED-HIGH) — CRLF header injection. Escaping reached only
Subject and attachment filename; display names, raw addresses,
Message-ID, In-Reply-To, References and attachment Content-Type were
emitted verbatim, and formatAddress escapes only backslash and quote.
In-Reply-To/References/display names are copied from inbound mail when
replying or forwarding, so the value is attacker-supplied. Sanitising
inside formatHeader covers all 17 call sites by construction; the three
headers assembled directly get stripCrlf explicitly.

Also adds auth:observe to the manifest. The plugin registers
onAfterLogout/onAccountSwitch — real hooks (lib/plugin-hooks.ts:362-363)
— without declaring the permission, so under B-09 the session-key wipe
would silently stop running.

verify-fixes.mjs carries 19 assertions including source checks that fail
if either guard is removed or a new unsanitised interpolated header
appears. That last one immediately caught the interpolated smime-type
Content-Type header, which manual review had dismissed as static.

Finding 2 (unauthenticated CBC accepted on decrypt) is NOT fixed. This
is not safe for real mail yet — sandbox accounts only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vnc/plugins/smime/src/smime-detect.js

@@ -0,0 +1,121 @@
+/**
+ * Detect S/MIME content in an email message. Ported from lib/smime/smime-detect.ts.
+ * Checks Content-Type, JMAP bodyStructure, and attachment metadata.
+ */
+
+export function detectSmime(contentType, bodyStructure, attachments) {
+  const noResult = { type: null, supported: false };
+
+  if (contentType) {
+    const ct = contentType.toLowerCase();
+
+    if (ct.includes('application/pkcs7-mime') || ct.includes('application/x-pkcs7-mime')) {
+      if (ct.includes('smime-type=enveloped-data')) {
+        const part = findCmsPart(bodyStructure, 'enveloped-data');
+        return { type: 'enveloped-data', blobId: part?.blobId, partId: part?.partId, supported: true };
+      }
+      if (ct.includes('smime-type=signed-data')) {
+        const part = findCmsPart(bodyStructure, 'signed-data');
+        return { type: 'signed-data', blobId: part?.blobId, partId: part?.partId, supported: true };
+      }
+      const part = findCmsPart(bodyStructure, null);
+      if (part) {
+        const partType = inferSmimeTypeFromContentType(part.type || '');
+        return {
+          type: partType,
+          blobId: part.blobId,
+          partId: part.partId,
+          supported: partType === 'enveloped-data' || partType === 'signed-data',
+        };
+      }
+    }
+
+    if (ct.includes('multipart/signed') && ct.includes('application/pkcs7-signature')) {
+      return { type: 'detached-sig', supported: false };
+    }
+  }
+
+  if (bodyStructure) {
+    const result = walkBodyStructure(bodyStructure);
+    if (result) return result;
+  }
+
+  if (attachments) {
+    for (const att of attachments) {
+      const type = att.type?.toLowerCase() || '';
+      const name = att.name?.toLowerCase() || '';
+
+      if (type.includes('application/pkcs7-mime') || type.includes('application/x-pkcs7-mime')) {
+        const smimeType = inferSmimeTypeFromContentType(type);
+        return {
+          type: smimeType,
+          blobId: att.blobId,
+          partId: att.partId,
+          supported: smimeType === 'enveloped-data' || smimeType === 'signed-data',
+        };
+      }
+      if (name.endsWith('.p7m')) {
+        return { type: 'enveloped-data', blobId: att.blobId, partId: att.partId, supported: true };
+      }
+      if (name.endsWith('.p7s')) {
+        return { type: 'detached-sig', blobId: att.blobId, partId: att.partId, supported: false };
+      }
+    }
+  }
+
+  return noResult;
+}
+
+function walkBodyStructure(part) {
+  const type = part.type?.toLowerCase() || '';
+
+  if (type.includes('application/pkcs7-mime') || type.includes('application/x-pkcs7-mime')) {
+    const smimeType = inferSmimeTypeFromContentType(type);
+    return {
+      type: smimeType,
+      blobId: part.blobId,
+      partId: part.partId,
+      supported: smimeType === 'enveloped-data' || smimeType === 'signed-data',
+    };
+  }
+
+  if (type === 'multipart/signed') {
+    if (part.subParts?.some((sp) => sp.type?.toLowerCase().includes('application/pkcs7-signature'))) {
+      return { type: 'detached-sig', supported: false };
+    }
+  }
+
+  if (part.subParts) {
+    for (const sub of part.subParts) {
+      const result = walkBodyStructure(sub);
+      if (result) return result;
+    }
+  }
+
+  return null;
+}
+
+function findCmsPart(bodyStructure, _smimeType) {
+  if (!bodyStructure) return null;
+  const type = bodyStructure.type?.toLowerCase() || '';
+  if (type.includes('application/pkcs7-mime') || type.includes('application/x-pkcs7-mime')) {
+    return bodyStructure;
+  }
+  if (bodyStructure.subParts) {
+    for (const sub of bodyStructure.subParts) {
+      const found = findCmsPart(sub, _smimeType);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+
+function inferSmimeTypeFromContentType(ct) {
+  const lower = ct.toLowerCase();
+  if (lower.includes('smime-type=enveloped-data')) return 'enveloped-data';
+  if (lower.includes('smime-type=signed-data')) return 'signed-data';
+  if (lower.includes('application/pkcs7-mime') || lower.includes('application/x-pkcs7-mime')) {
+    return 'enveloped-data';
+  }
+  return null;
+}