TokenChallenge extends Challenge { protected String getToken() { String token = getJSON().get(KEY_TOKEN).asString(); if (!AcmeUtils.isValidBase64Url(token)) { throw new AcmeProtocolException("Invalid token: " + token); } return token; } TokenChallenge(Login login, JSON data); String getAuthorization();  }
@Test public void testInvalidToken() throws IOException { TestableConnectionProvider provider = new TestableConnectionProvider(); Login login = provider.createLogin(); JSONBuilder jb = new JSONBuilder(); jb.put("url", "https: jb.put("type", "generic"); jb.put("token", "<script>someMaliciousCode()</script>"); TokenChallenge challenge = new TokenChallenge(login, jb.toJSON()); try { challenge.getToken(); fail("Invalid token was accepted"); } catch (AcmeProtocolException ex) { } provider.close(); }