fix(security): address review comments on SSRF PR

- Remove Promise.race timeout pattern to avoid unhandled rejections
  (http.request timeout is sufficient for webhook delivery)
- Use safeCompare in verifyCronAuth instead of inline HMAC logic
- Strip IPv6 brackets before validateDatabaseHost in Redis route

Author: waleedlatif1

apps/sim/app/api/tools/redis/execute/route.ts

@@ -26,7 +26,11 @@ export async function POST(request: NextRequest) {
     const { url, command, args } = RequestSchema.parse(body)
 
     const parsedUrl = new URL(url)
-    const hostValidation = await validateDatabaseHost(parsedUrl.hostname, 'host')
+    const hostname =
+      parsedUrl.hostname.startsWith('[') && parsedUrl.hostname.endsWith(']')
+        ? parsedUrl.hostname.slice(1, -1)
+        : parsedUrl.hostname
+    const hostValidation = await validateDatabaseHost(hostname, 'host')
     if (!hostValidation.isValid) {
       return NextResponse.json({ error: hostValidation.error }, { status: 400 })
     }

apps/sim/app/api/workspaces/[id]/notifications/[notificationId]/test/route.ts

@@ -137,7 +137,7 @@ async function testWebhook(subscription: typeof workspaceNotificationSubscriptio
   }
 
   try {
-    const fetchPromise = secureFetchWithValidation(
+    const response = await secureFetchWithValidation(
       webhookConfig.url,
       {
         method: 'POST',
@@ -147,12 +147,6 @@ async function testWebhook(subscription: typeof workspaceNotificationSubscriptio
       },
       'webhookUrl'
     )
-
-    const timeoutPromise = new Promise<never>((_resolve, reject) => {
-      setTimeout(() => reject(new Error('Request timeout')), 10000)
-    })
-
-    const response = await Promise.race([fetchPromise, timeoutPromise])
     const responseBody = await response.text().catch(() => '')
 
     return {

apps/sim/background/workspace-notification-delivery.ts

@@ -209,7 +209,7 @@ async function deliverWebhook(
   }
 
   try {
-    const fetchPromise = secureFetchWithValidation(
+    const response = await secureFetchWithValidation(
       webhookConfig.url,
       {
         method: 'POST',
@@ -220,12 +220,6 @@ async function deliverWebhook(
       'webhookUrl'
     )
 
-    const timeoutPromise = new Promise<never>((_resolve, reject) => {
-      setTimeout(() => reject(new Error('Request timeout')), 30000)
-    })
-
-    const response = await Promise.race([fetchPromise, timeoutPromise])
-
     return {
       success: response.ok,
       status: response.status,

apps/sim/lib/auth/internal.ts

@@ -1,8 +1,8 @@
-import { createHmac, timingSafeEqual } from 'crypto'
 import { createLogger } from '@sim/logger'
 import { jwtVerify, SignJWT } from 'jose'
 import { type NextRequest, NextResponse } from 'next/server'
 import { env } from '@/lib/core/config/env'
+import { safeCompare } from '@/lib/core/security/encryption'
 
 const logger = createLogger('CronAuth')
 
@@ -82,13 +82,7 @@ export function verifyCronAuth(request: NextRequest, context?: string): NextResp
 
   const authHeader = request.headers.get('authorization')
   const expectedAuth = `Bearer ${env.CRON_SECRET}`
-  const key = 'verifyCronAuth'
-  const isValid =
-    authHeader !== null &&
-    timingSafeEqual(
-      createHmac('sha256', key).update(authHeader).digest(),
-      createHmac('sha256', key).update(expectedAuth).digest()
-    )
+  const isValid = authHeader !== null && safeCompare(authHeader, expectedAuth)
   if (!isValid) {
     const contextInfo = context ? ` for ${context}` : ''
     logger.warn(`Unauthorized CRON access attempt${contextInfo}`, {