From 797c9241de7037983e62b9fab064e50f69eb3aa0 Mon Sep 17 00:00:00 2001
From: Alexander Hesse <alexander.hesse@sandstorm.de>
Date: Wed, 17 Sep 2025 22:17:23 +0200
Subject: [PATCH] BUGFIX: catch InvalidHmacErrors in
 DefaultFormStateInitializer

---
 Classes/FormState/DefaultFormStateInitializer.php | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/Classes/FormState/DefaultFormStateInitializer.php b/Classes/FormState/DefaultFormStateInitializer.php
index 20cda49..53152c2 100644
--- a/Classes/FormState/DefaultFormStateInitializer.php
+++ b/Classes/FormState/DefaultFormStateInitializer.php
@@ -16,6 +16,8 @@
 use Neos\Flow\Annotations as Flow;
 use Neos\Flow\Mvc\ActionRequest;
 use Neos\Flow\Security\Cryptography\HashService;
+use Neos\Flow\Security\Exception\InvalidArgumentForHashGenerationException;
+use Neos\Flow\Security\Exception\InvalidHashException;
 use Neos\Form\Core\Model\FormDefinition;
 use Neos\Form\Core\Runtime\FormState;
 
@@ -31,7 +33,11 @@ public function initializeFormState(FormDefinition $formDefinition, ActionReques
     {
         $serializedFormStateWithHmac = $actionRequest->getInternalArgument('__state');
         if ($serializedFormStateWithHmac !== null) {
-            $serializedFormState = $this->hashService->validateAndStripHmac($serializedFormStateWithHmac);
+            try {
+                $serializedFormState = $this->hashService->validateAndStripHmac($serializedFormStateWithHmac);
+            } catch (InvalidArgumentForHashGenerationException | InvalidHashException) {
+                return new FormState();
+            }
             /** @noinspection UnserializeExploitsInspection The unserialize call is safe because of the HMAC check above */
             return unserialize(base64_decode($serializedFormState));
         }