Repository: symfony/symfony
File: src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php (PHP)

Code before:
{
    public function __construct(
        private readonly CsrfTokenManagerInterface $csrfTokenManager,
        private ?ExpressionLanguage $expressionLanguage = null,
    ) {
    }

    public function onKernelControllerArguments(ControllerArgumentsEvent $event): void
    {
        if (!$attributes = $event->getAttributes(IsCsrfTokenValid::class)) {
            return;
        }

        $request = $event->getRequest();
        $arguments = $event->getNamedArguments();

        foreach ($attributes as $attribute) {
            $id = $this->getTokenId($attribute->id, $request, $arguments);
            $methods = array_map('strtoupper', (array) $attribute->methods);

            if ($methods && !\in_array($request->getMethod(), $methods, true)) {
                continue;
            }

            $tokenValue = $this->getTokenValue($request, $attribute->tokenSource, $attribute->tokenKey);
            if (!$this->csrfTokenManager->isTokenValid(new CsrfToken($id, $tokenValue))) {
                throw new InvalidCsrfTokenException('Invalid CSRF token.');
            }
        }
    }

    public static function getSubscribedEvents(): array
    {
        return [KernelEvents::CONTROLLER_ARGUMENTS => ['onKernelControllerArguments', 25]];
    }

    private function getTokenId(string|Expression $id, Request $request, array $arguments): string
    {
        if (!$id instanceof Expression) {
            return $id;
        }

        $this->expressionLanguage ??= new ExpressionLanguage();

        return (string) $this->expressionLanguage->evaluate($id, [
            'request' => $request,
            'args' => $arguments,
        ]);
    }

    private function getTokenValue(Request $request, int $tokenSource, string $tokenKey): ?string

Review comment (suggestion):
this does not properly handle the case where `getTokenValue` returns `null`

Code after:
{
    public function __construct(
        private readonly CsrfTokenManagerInterface $csrfTokenManager,
        private ?ExpressionLanguage $expressionLanguage = null,
    ) {
    }

    public function onKernelControllerArguments(ControllerArgumentsEvent $event): void
    {
        if (!$attributes = $event->getAttributes(IsCsrfTokenValid::class)) {
            return;
        }

        $request = $event->getRequest();
        $arguments = $event->getNamedArguments();

        foreach ($attributes as $attribute) {
            $id = $this->getTokenId($attribute->id, $request, $arguments);
            $methods = array_map('strtoupper', (array) $attribute->methods);

            if ($methods && !\in_array($request->getMethod(), $methods, true)) {
                continue;
            }

            $tokenValue = $this->getTokenValue($request, $attribute->tokenSource, $attribute->tokenKey);
            if (
                null === $tokenValue
                || !$this->csrfTokenManager->isTokenValid(new CsrfToken($id, $tokenValue))
            ) {
                throw new InvalidCsrfTokenException('Invalid CSRF token.');
            }
        }
    }

    public static function getSubscribedEvents(): array
    {
        return [KernelEvents::CONTROLLER_ARGUMENTS => ['onKernelControllerArguments', 25]];
    }

    private function getTokenId(string|Expression $id, Request $request, array $arguments): string
    {
        if (!$id instanceof Expression) {
            return $id;
        }

        $this->expressionLanguage ??= new ExpressionLanguage();

        return (string) $this->expressionLanguage->evaluate($id, [
            'request' => $request,
            'args' => $arguments,
        ]);