fix(twilio): reject malformed webhook signatures

src/lib/providers/__tests__/twilio.test.ts

@@ -146,5 +146,18 @@ describe("TwilioProvider", () => {
       const result = provider.validateWebhook("Body=test", headers, "https://example.com");
       expect(result).toBe(false);
     });
+
+    it("returns false for a malformed signature length", () => {
+      process.env.TWILIO_AUTH_TOKEN = "auth_token_123";
+      const headers = new Headers({ "x-twilio-signature": "invalid" });
+
+      const result = provider.validateWebhook(
+        "Body=test",
+        headers,
+        "https://example.com"
+      );
+
+      expect(result).toBe(false);
+    });
   });
 });

src/lib/providers/twilio.ts

@@ -91,9 +91,11 @@ export class TwilioProvider implements SMSProvider {
     });
 
     const expected = getSignature(authToken, url, params);
-    return crypto.timingSafeEqual(
-      Buffer.from(signature),
-      Buffer.from(expected)
+    const signatureBuffer = Buffer.from(signature);
+    const expectedBuffer = Buffer.from(expected);
+    return (
+      signatureBuffer.length === expectedBuffer.length &&
+      crypto.timingSafeEqual(signatureBuffer, expectedBuffer)
     );
   }
 }