chore: replace scmp with crypto.timingSafeEqual

Author: Methuselah96

package.json

@@ -25,7 +25,6 @@
     "https-proxy-agent": "^5.0.0",
     "jsonwebtoken": "^9.0.3",
     "qs": "^6.14.1",
-    "scmp": "^2.1.0",
     "xmlbuilder": "^13.0.2"
   },
   "devDependencies": {

src/webhooks/webhooks.ts

@@ -1,4 +1,3 @@
-const scmp = require("scmp");
 import crypto from "crypto";
 import urllib from "url";
 import { IncomingHttpHeaders } from "http2";
@@ -257,15 +256,23 @@ function validateSignatureWithUrl(
     params
   );
 
-  return scmp(Buffer.from(twilioHeader), Buffer.from(signatureWithoutPort));
+  return timingSafeEqual(
+    Buffer.from(twilioHeader),
+    Buffer.from(signatureWithoutPort)
+  );
 }
 
 export function validateBody(
   body: string,
   bodyHash: any[] | string | Buffer
 ): boolean {
   var expectedHash = getExpectedBodyHash(body);
-  return scmp(Buffer.from(bodyHash), Buffer.from(expectedHash));
+  return timingSafeEqual(Buffer.from(bodyHash), Buffer.from(expectedHash));
+}
+
+function timingSafeEqual(a: Buffer, b: Buffer) {
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(a, b);
 }
 
 /**