DataRecordUploadToken { public static DataRecordUploadToken fromEncodedToken(@NotNull String encoded, @NotNull byte[] secret) throws IllegalArgumentException { final String[] parts = encoded.split("#", 2); if (parts.length < 2) { throw new IllegalArgumentException("Invalid upload token"); } final String toBeDecoded = parts[0]; final String expectedSig = parts[1]; final String actualSig = getSignedString(toBeDecoded, secret); if (!expectedSig.equals(actualSig)) { throw new IllegalArgumentException("Invalid upload token"); } String decoded = decodeBase64(toBeDecoded); String decodedParts[] = decoded.split("#"); if (decodedParts.length < 2) { throw new IllegalArgumentException("Invalid upload token"); } return new DataRecordUploadToken(decodedParts[0], decodedParts.length > 2 ? decodedParts[2] : null); } DataRecordUploadToken(@NotNull String blobId, @Nullable String uploadId); static DataRecordUploadToken fromEncodedToken(@NotNull String encoded, @NotNull byte[] secret); String getEncodedToken(@NotNull byte[] secret); String getBlobId(); Optional<String> getUploadId();  }
@Test public void testUploadTokenSignature() { String spoofedToken = Base64.encodeBase64String((BLOB_ID + "#" + UPLOAD_ID).getBytes(StandardCharsets.UTF_8)); try { DataRecordUploadToken.fromEncodedToken(spoofedToken, SECRET); } catch (IllegalArgumentException expected) { } }