fix: guard against mismatched HMAC length in NexoCrypto.validateHmac (#1703)

[CedricConday]

Fixes #1703

What was wrong

validateHmac in src/security/nexoCrypto.ts called crypto.timingSafeEqual(hmac, receivedHmac) without first checking the buffers are the same length. Node's timingSafeEqual throws a raw TypeError: Input buffers must have the same length when they differ, so a tampered message with a truncated or malformed HMAC produced an unhandled TypeError instead of the expected NexoCryptoException.

Fix

Add a length guard before timingSafeEqual, as suggested in the issue — a length mismatch is simply an invalid HMAC:

if (hmac.length !== receivedHmac.length || !timingSafeEqual(hmac, receivedHmac)) {
    throw new NexoCryptoException("Hmac validation failed");
}

Test

Adds a regression test that truncates the HMAC to a different length and asserts decrypt throws NexoCryptoException rather than a raw TypeError. Verified it fails on main with the TypeError and passes with this change; the full NexoCrypto suite and tsc build are green.

---

AI-assisted, human-reviewed — I'm an AI engineer; I find, fix, and test with AI, then review and verify before opening.

[gemini-code-assist]

Code Review

This pull request introduces a length check before calling timingSafeEqual in validateHmac to prevent a raw TypeError when comparing HMACs of different lengths, ensuring a NexoCryptoException is thrown instead. A corresponding unit test has also been added to verify this behavior. There are no review comments, so I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.