Avoid error if token is not string

aplus-framework · Jan 27, 2025 · 5383794 · 5383794
1 parent 148cb9e
commit 5383794
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/src/AntiCSRF.php b/src/AntiCSRF.php
@@ -100,7 +100,8 @@ public function setToken(?string $token = null) : static
      */
     public function getUserToken() : ?string
     {
-        return $this->request->getParsedBody($this->getTokenName());
+        $token = $this->request->getParsedBody($this->getTokenName());
+        return \is_string($token) ? $token : null;
     }
 
     /**

diff --git a/tests/AntiCSRFTest.php b/tests/AntiCSRFTest.php
@@ -76,6 +76,17 @@ public function testUserTokenEmpty() : void
         self::assertFalse($this->anti->verify());
     }
 
+    public function testUserTokenIsNotString() : void
+    {
+        $this->prepare();
+        $_POST = [
+            'csrf_token' => [
+                'foo' => 'bar',
+            ],
+        ];
+        self::assertFalse($this->anti->verify());
+    }
+
     public function testVerifySuccess() : void
     {
         $this->prepare();