symfony
diff --git a/‎src/Symfony/Component/Security/Csrf/CsrfTokenManager.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Csrf/CsrfTokenManager.php
+4Lines changed: 4 additions & 0 deletions b/‎src/Symfony/Component/Security/Csrf/CsrfTokenManager.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Csrf/CsrfTokenManager.php
+4Lines changed: 4 additions & 0 deletions
diff --git a/‎src/Symfony/Component/Security/Csrf/Tests/CsrfTokenManagerTest.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Csrf/Tests/CsrfTokenManagerTest.php
+20Lines changed: 20 additions & 0 deletions b/‎src/Symfony/Component/Security/Csrf/Tests/CsrfTokenManagerTest.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Security/Csrf/Tests/CsrfTokenManagerTest.php
+20Lines changed: 20 additions & 0 deletions
@@ -136,6 +136,10 @@ private function derandomize(string $value): string
         $key = base64_decode(strtr($parts[1], '-_', '+/'));
         $value = base64_decode(strtr($parts[2], '-_', '+/'));
 
+        if (!$key || !$value) {
+            return '';
+        }
+
         return $this->xor($value, $key);
     }
 
 
@@ -193,6 +193,26 @@ public function testNonExistingTokenIsNotValid($namespace, $manager, $storage)
         $this->assertFalse($manager->isTokenValid(new CsrfToken('token_id', 'FOOBAR')));
     }
 
+    public function testTokenShouldNotTriggerDivisionByZero()
+    {
+        [$generator, $storage] = $this->getGeneratorAndStorage();
+        $manager = new CsrfTokenManager($generator, $storage);
+
+        // Scenario: the token that was returned is abc.def.ghi, and gets modified in the browser to abc..ghi
+
+        $storage->expects($this->once())
+            ->method('hasToken')
+            ->with('https-token_id')
+            ->willReturn(true);
+
+        $storage->expects($this->once())
+            ->method('getToken')
+            ->with('https-token_id')
+            ->willReturn('def');
+
+        $this->assertFalse($manager->isTokenValid(new CsrfToken('token_id', 'abc..ghi')));
+    }
+
     /**
      * @dataProvider getManagerGeneratorAndStorage
      */