Better sanitize values

https://hackerone.com/reports/24185
You've changed the return signature from `StdClass` to `StdClass | null` because you're not returning outside of this conditional.