UD-12010 updated webhook verify to be more secure

[Yaniv-Nimni]

No description provided.

[Copilot]

Pull Request Overview

This PR improves webhook signature verification security by replacing string comparison with timing-safe comparison to prevent timing attacks.

• Replaces direct string comparison with crypto.timingSafeEqual() for webhook signature verification
• Adds proper buffer handling for base64 signature comparison
• Includes test coverage for the updated webhook verification method

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
resources/webhooks.ts	Updates verify method to use timing-safe comparison with buffer conversion
tests/webhooks.spec.ts	Adds test case for webhook signature verification functionality

[Copilot]

The comparison will fail because hmac.digest() returns a Buffer while signatureBuffer is created from base64. Both should use the same encoding - either both as base64 strings or both as raw Buffers. Consider using hmac.digest('base64') or converting signatureBuffer to raw bytes.

Suggested change

	return crypto.timingSafeEqual(hmac.digest(), signatureBuffer)
	const computedSignatureBuffer = Buffer.from(hmac.digest('base64'), 'base64')
	return crypto.timingSafeEqual(computedSignatureBuffer, signatureBuffer)