Avoid error if token is not string

aplus-framework · Jan 27, 2025 · adb32e8 · adb32e8
1 parent 736bfcf
commit adb32e8
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/src/AntiCSRF.php b/src/AntiCSRF.php
@@ -162,7 +162,8 @@ public function generateToken() : string
      */
     public function getUserToken() : ?string
     {
-        return $this->request->getParsedBody($this->getTokenName());
+        $token = $this->request->getParsedBody($this->getTokenName());
+        return \is_string($token) ? $token : null;
     }
 
     /**

diff --git a/tests/AntiCSRFTest.php b/tests/AntiCSRFTest.php
@@ -152,6 +152,17 @@ public function testUserTokenEmpty() : void
         self::assertFalse($this->anti->verify());
     }
 
+    public function testUserTokenIsNotString() : void
+    {
+        $this->prepare();
+        $_POST = [
+            'csrf_token' => [
+                'foo' => 'bar',
+            ],
+        ];
+        self::assertFalse($this->anti->verify());
+    }
+
     public function testVerifySuccess() : void
     {
         $this->prepare();