always strip s/mime signatures in incoming emails

lib/email/receiver.rb

@@ -429,6 +429,9 @@ module Email
     def create_post_with_attachments(options={})
       # deal with attachments
       @mail.attachments.each do |attachment|
+        # always strip S/MIME signatures
+        next if attachment.content_type == "application/pkcs7-mime".freeze
+
         tmp = Tempfile.new("discourse-email-attachment")
         begin
           # read attachment

lib/validators/upload_validator.rb

@@ -5,7 +5,11 @@ module Validators; end
 class Validators::UploadValidator < ActiveModel::Validator
 
   def validate(upload)
-    return true if upload.is_attachment_for_group_message && SiteSetting.allow_all_attachments_for_group_messages
+    # allow all attachments except S/MIME signatures
+    # cf. https://meta.discourse.org/t/strip-s-mime-signatures/46371
+    if upload.is_attachment_for_group_message && SiteSetting.allow_all_attachments_for_group_messages
+      return upload.original_filename != "smime.p7s".freeze
+    end
 
     extension = File.extname(upload.original_filename)[1..-1] || ""