From 35b71a945b9ca76e3da098dd35009644240bb719 Mon Sep 17 00:00:00 2001
From: rissrice2105-agent
 <289161642+rissrice2105-agent@users.noreply.github.com>
Date: Fri, 17 Jul 2026 14:55:38 -0600
Subject: [PATCH] fix(twilio): reject malformed webhook signatures

---
 src/lib/providers/__tests__/twilio.test.ts | 13 +++++++++++++
 src/lib/providers/twilio.ts                |  8 +++++---
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/src/lib/providers/__tests__/twilio.test.ts b/src/lib/providers/__tests__/twilio.test.ts
index 170e604f..5838c4e7 100644
--- a/src/lib/providers/__tests__/twilio.test.ts
+++ b/src/lib/providers/__tests__/twilio.test.ts
@@ -146,5 +146,18 @@ describe("TwilioProvider", () => {
       const result = provider.validateWebhook("Body=test", headers, "https://example.com");
       expect(result).toBe(false);
     });
+
+    it("returns false for a malformed signature length", () => {
+      process.env.TWILIO_AUTH_TOKEN = "auth_token_123";
+      const headers = new Headers({ "x-twilio-signature": "invalid" });
+
+      const result = provider.validateWebhook(
+        "Body=test",
+        headers,
+        "https://example.com"
+      );
+
+      expect(result).toBe(false);
+    });
   });
 });
diff --git a/src/lib/providers/twilio.ts b/src/lib/providers/twilio.ts
index 71213046..ac5fff2b 100644
--- a/src/lib/providers/twilio.ts
+++ b/src/lib/providers/twilio.ts
@@ -91,9 +91,11 @@ export class TwilioProvider implements SMSProvider {
     });
 
     const expected = getSignature(authToken, url, params);
-    return crypto.timingSafeEqual(
-      Buffer.from(signature),
-      Buffer.from(expected)
+    const signatureBuffer = Buffer.from(signature);
+    const expectedBuffer = Buffer.from(expected);
+    return (
+      signatureBuffer.length === expectedBuffer.length &&
+      crypto.timingSafeEqual(signatureBuffer, expectedBuffer)
     );
   }
 }