ParseHttpBodyParams.java

    // This method exists to work around a quirk in HttpServletRequest. For validation we only
    // need to consider the parameters from the request *body*, but HSR.getParameterMap() *also* includes
    // any parameters found in the query String, which will cause validation to fail.
    // For POST requests, Twilio will not add any queryString params, but it's perfectly possible for a
    // user to do that by including them in the webhook URL.
    private HashMap<String, String> extractOnlyBodyParams(HttpServletRequest request, String validationUrl) throws IOException {

        var allRequestParameters = request.getParameterMap();
        var queryStringParams = UriComponentsBuilder.fromUriString(validationUrl).build().getQueryParams();

        var validationParams = new HashMap<String, String>();

        // loop through _all_ parameters, only keeping ones which _don't_ appear in the query string.
        allRequestParameters.forEach((name, values) -> {
            for (String value : values) {
                if (!(queryStringParams.containsKey(name) && queryStringParams.get(name).contains(value))) {
                    validationParams.put(name, value);
                }
            }
        });

        return validationParams;
    }