Avoid error if token is not string

Author: natanfelles

src/AntiCSRF.php

@@ -100,7 +100,8 @@ public function setToken(?string $token = null) : static
      */
     public function getUserToken() : ?string
     {
-        return $this->request->getParsedBody($this->getTokenName());
+        $token = $this->request->getParsedBody($this->getTokenName());
+        return \is_string($token) ? $token : null;
     }
 
     /**

tests/AntiCSRFTest.php

@@ -76,6 +76,17 @@ public function testUserTokenEmpty() : void
         self::assertFalse($this->anti->verify());
     }
 
+    public function testUserTokenIsNotString() : void
+    {
+        $this->prepare();
+        $_POST = [
+            'csrf_token' => [
+                'foo' => 'bar',
+            ],
+        ];
+        self::assertFalse($this->anti->verify());
+    }
+
     public function testVerifySuccess() : void
     {
         $this->prepare();