handle request php://input

system/Security/Security.php

@@ -321,7 +321,9 @@ private function getPostedToken(RequestInterface $request): ?string
         if ($body !== '') {
             $json = json_decode($body);
             if ($json !== null && json_last_error() === JSON_ERROR_NONE) {
-                return $json->{$this->config->tokenName} ?? null;
+                $tokenValue = $json->{$this->config->tokenName} ?? null;
+
+                return is_string($tokenValue) ? $tokenValue : null;
             }
 
             parse_str($body, $parsed);

tests/system/Security/SecurityTest.php

@@ -342,4 +342,34 @@ public function testGetPostedTokenReturnsNullWhenMaliciousData(): void
 
         $this->assertNull($method($request));
     }
+
+    public function testGetPostedTokenReturnsTokenFromJsonInput(): void
+    {
+        $_POST    = [];
+        $jsonBody = json_encode(['csrf_test_name' => '8b9218a55906f9dcc1dc263dce7f005a']);
+        $request  = $this->createIncomingRequest()->setBody($jsonBody);
+        $method   = $this->getPrivateMethodInvoker($this->createMockSecurity(), 'getPostedToken');
+
+        $this->assertSame('8b9218a55906f9dcc1dc263dce7f005a', $method($request));
+    }
+
+    public function testGetPostedTokenReturnsTokenFromFormEncodedInput(): void
+    {
+        $_POST    = [];
+        $formBody = 'csrf_test_name=8b9218a55906f9dcc1dc263dce7f005a';
+        $request  = $this->createIncomingRequest()->setBody($formBody);
+        $method   = $this->getPrivateMethodInvoker($this->createMockSecurity(), 'getPostedToken');
+
+        $this->assertSame('8b9218a55906f9dcc1dc263dce7f005a', $method($request));
+    }
+
+    public function testGetPostedTokenReturnsNullFromMaliciousJsonInput(): void
+    {
+        $_POST         = [];
+        $maliciousJson = json_encode(['csrf_test_name' => ['malicious' => 'data']]);
+        $request       = $this->createIncomingRequest()->setBody($maliciousJson);
+        $method        = $this->getPrivateMethodInvoker($this->createMockSecurity(), 'getPostedToken');
+
+        $this->assertNull($method($request));
+    }
 }