Extension: how to use PhabricatorFile::newFromFileData()

I don't remember the details; It's possible that a CSRF token is created in the Form class ("PhabricatorForm"? "PhutilForm"?), and is only available in POST responses ($request->isFormPost()).

https://we.phorge.it/source/phorge/browse/master/src/applications/files/controller/PhabricatorFileUploadController.php is an example of a controller creating a file with no javascript code (the DopUpload controller needs cooperation from some javscript).

This sounds indeed logical that it's only for POST calls.
I'll look into it further this week