Tighten string to non-empty-string where possible

Makefile

@@ -12,7 +12,7 @@ vendor/composer/installed.json: composer.json composer.lock
 
 .PHONY: phpunit
 phpunit:
-	@php -d assert.exception=1 -d zend.assertions=1 vendor/bin/phpunit
+	@php -d assert.exception=1 -d zend.assertions=1 vendor/bin/phpunit $(PHPUNIT_FLAGS)
 
 .PHONY: infection
 infection:

src/Decoder.php

@@ -10,6 +10,8 @@ interface Decoder
     /**
      * Decodes from JSON, validating the errors
      *
+     * @param non-empty-string $json
+     *
      * @throws CannotDecodeContent When something goes wrong while decoding.
      */
     public function jsonDecode(string $json): mixed;
@@ -19,6 +21,8 @@ public function jsonDecode(string $json): mixed;
      *
      * @link http://tools.ietf.org/html/rfc4648#section-5
      *
+     * @return ($data is non-empty-string ? non-empty-string : string)
+     *
      * @throws CannotDecodeContent When something goes wrong while decoding.
      */
     public function base64UrlDecode(string $data): string;

src/Encoder.php

@@ -10,6 +10,8 @@ interface Encoder
     /**
      * Encodes to JSON, validating the errors
      *
+     * @return non-empty-string
+     *
      * @throws CannotEncodeContent When something goes wrong while encoding.
      */
     public function jsonEncode(mixed $data): string;
@@ -18,6 +20,8 @@ public function jsonEncode(mixed $data): string;
      * Encodes to base64url
      *
      * @link http://tools.ietf.org/html/rfc4648#section-5
+     *
+     * @return ($data is non-empty-string ? non-empty-string : string)
      */
     public function base64UrlEncode(string $data): string;
 }

src/Encoding/JoseEncoder.php

@@ -8,6 +8,7 @@
 use Lcobucci\JWT\Encoder;
 use Lcobucci\JWT\SodiumBase64Polyfill;
 
+use function assert;
 use function json_decode;
 use function json_encode;
 
@@ -23,10 +24,14 @@ final class JoseEncoder implements Encoder, Decoder
     public function jsonEncode(mixed $data): string
     {
         try {
-            return json_encode($data, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);
+            $jsonEncoded = json_encode($data, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);
         } catch (JsonException $exception) {
             throw CannotEncodeContent::jsonIssues($exception);
         }
+
+        assert($jsonEncoded !== '');
+
+        return $jsonEncoded;
     }
 
     public function jsonDecode(string $json): mixed

src/JwtFacade.php

@@ -45,6 +45,7 @@ public function issue(
         return $customiseBuilder($builder, $now)->getToken($signer, $signingKey);
     }
 
+    /** @param non-empty-string $jwt */
     public function parse(
         string $jwt,
         SignedWith $signedWith,

src/Parser.php

@@ -12,6 +12,8 @@ interface Parser
     /**
      * Parses the JWT and returns a token
      *
+     * @param non-empty-string $jwt
+     *
      * @throws CannotDecodeContent      When something goes wrong while decoding.
      * @throws InvalidTokenStructure    When token string structure is invalid.
      * @throws UnsupportedHeaderFound   When parsed token has an unsupported header.

src/Signer.php

@@ -12,12 +12,16 @@ interface Signer
 {
     /**
      * Returns the algorithm id
+     *
+     * @return non-empty-string
      */
     public function algorithmId(): string;
 
     /**
      * Creates a hash for the given payload
      *
+     * @param non-empty-string $payload
+     *
      * @throws CannotSignPayload  When payload signing fails.
      * @throws InvalidKeyProvided When issue key is invalid/incompatible.
      * @throws ConversionFailed   When signature could not be converted.
@@ -27,6 +31,8 @@ public function sign(string $payload, Key $key): string;
     /**
      * Returns if the expected hash matches with the data and key
      *
+     * @param non-empty-string $payload
+     *
      * @throws InvalidKeyProvided When issue key is invalid/incompatible.
      * @throws ConversionFailed   When signature could not be converted.
      */

src/Signer/Blake2b.php

@@ -5,6 +5,7 @@
 
 use Lcobucci\JWT\Signer;
 
+use function assert;
 use function hash_equals;
 use function sodium_crypto_generichash;
 use function strlen;
@@ -26,7 +27,10 @@ public function sign(string $payload, Key $key): string
             throw InvalidKeyProvided::tooShort(self::MINIMUM_KEY_LENGTH_IN_BITS, $actualKeyLength);
         }
 
-        return sodium_crypto_generichash($payload, $key->contents());
+        $hash = sodium_crypto_generichash($payload, $key->contents());
+        assert($hash !== '');
+
+        return $hash;
     }
 
     public function verify(string $expected, string $payload, Key $key): bool

src/Signer/Ecdsa.php

@@ -6,6 +6,8 @@
 use Lcobucci\JWT\Signer\Ecdsa\MultibyteStringConverter;
 use Lcobucci\JWT\Signer\Ecdsa\SignatureConverter;
 
+use function assert;
+
 use const OPENSSL_KEYTYPE_EC;
 
 abstract class Ecdsa extends OpenSSL
@@ -19,6 +21,7 @@ public static function create(): Ecdsa
         return new static(new MultibyteStringConverter());  // @phpstan-ignore-line
     }
 
+    /** @return  non-empty-string */
     final public function sign(string $payload, Key $key): string
     {
         return $this->converter->fromAsn1(
@@ -29,6 +32,8 @@ final public function sign(string $payload, Key $key): string
 
     final public function verify(string $expected, string $payload, Key $key): bool
     {
+        assert($expected !== '');
+
         return $this->verifySignature(
             $this->converter->toAsn1($expected, $this->pointLength()),
             $payload,

src/Signer/Ecdsa/MultibyteStringConverter.php

@@ -65,6 +65,7 @@ public function toAsn1(string $points, int $length): string
             . self::ASN1_INTEGER . dechex($lengthS) . $pointS,
         );
         assert(is_string($asn1));
+        assert($asn1 !== '');
 
         return $asn1;
     }
@@ -109,6 +110,7 @@ public function fromAsn1(string $signature, int $length): string
 
         $points = hex2bin(str_pad($pointR, $length, '0', STR_PAD_LEFT) . str_pad($pointS, $length, '0', STR_PAD_LEFT));
         assert(is_string($points));
+        assert($points !== '');
 
         return $points;
     }

src/Signer/Ecdsa/SignatureConverter.php

@@ -21,13 +21,19 @@ interface SignatureConverter
     /**
      * Converts the signature generated by OpenSSL into what JWA defines
      *
+     * @return non-empty-string
+     *
      * @throws ConversionFailed When there was an issue during the format conversion.
      */
     public function fromAsn1(string $signature, int $length): string;
 
     /**
      * Converts the JWA signature into something OpenSSL understands
      *
+     * @param non-empty-string $points
+     *
+     * @return non-empty-string
+     *
      * @throws ConversionFailed When there was an issue during the format conversion.
      */
     public function toAsn1(string $points, int $length): string;

src/Signer/Eddsa.php

@@ -6,6 +6,7 @@
 use Lcobucci\JWT\Signer;
 use SodiumException;
 
+use function assert;
 use function sodium_crypto_sign_detached;
 use function sodium_crypto_sign_verify_detached;
 
@@ -19,10 +20,14 @@ public function algorithmId(): string
     public function sign(string $payload, Key $key): string
     {
         try {
-            return sodium_crypto_sign_detached($payload, $key->contents());
+            $signature = sodium_crypto_sign_detached($payload, $key->contents());
         } catch (SodiumException $sodiumException) {
             throw new InvalidKeyProvided($sodiumException->getMessage(), 0, $sodiumException);
         }
+
+        assert($signature !== '');
+
+        return $signature;
     }
 
     public function verify(string $expected, string $payload, Key $key): bool

src/Signer/Hmac.php

@@ -27,6 +27,7 @@ final public function verify(string $expected, string $payload, Key $key): bool
         return hash_equals($expected, $this->sign($payload, $key));
     }
 
+    /** @return non-empty-string */
     abstract public function algorithm(): string;
 
     /** @return positive-int */

src/Signer/OpenSSL.php

@@ -34,6 +34,8 @@ abstract class OpenSSL implements Signer
     ];
 
     /**
+     * @return non-empty-string
+     *
      * @throws CannotSignPayload
      * @throws InvalidKeyProvided
      */

src/SodiumBase64Polyfill.php

@@ -23,6 +23,7 @@ final class SodiumBase64Polyfill
     public const SODIUM_BASE64_VARIANT_URLSAFE             = 5;
     public const SODIUM_BASE64_VARIANT_URLSAFE_NO_PADDING  = 7;
 
+    /** @return ($decoded is non-empty-string ? non-empty-string : string) */
     public static function bin2base64(string $decoded, int $variant): string
     {
         if (! function_exists('sodium_bin2base64')) {
@@ -32,6 +33,7 @@ public static function bin2base64(string $decoded, int $variant): string
         return sodium_bin2base64($decoded, $variant);
     }
 
+    /** @return ($decoded is non-empty-string ? non-empty-string : string) */
     public static function bin2base64Fallback(string $decoded, int $variant): string
     {
         $encoded = base64_encode($decoded);
@@ -53,7 +55,11 @@ public static function bin2base64Fallback(string $decoded, int $variant): string
         return $encoded;
     }
 
-    /** @throws CannotDecodeContent */
+    /**
+     * @return ($encoded is non-empty-string ? non-empty-string : string)
+     *
+     * @throws CannotDecodeContent
+     */
     public static function base642bin(string $encoded, int $variant): string
     {
         if (! function_exists('sodium_base642bin')) {
@@ -67,7 +73,11 @@ public static function base642bin(string $encoded, int $variant): string
         }
     }
 
-    /** @throws CannotDecodeContent */
+    /**
+     * @return ($encoded is non-empty-string ? non-empty-string : string)
+     *
+     * @throws CannotDecodeContent
+     */
     public static function base642binFallback(string $encoded, int $variant): string
     {
         if (

src/Token.php

@@ -50,6 +50,8 @@ public function isExpired(DateTimeInterface $now): bool;
 
     /**
      * Returns an encoded representation of the token
+     *
+     * @return non-empty-string
      */
     public function toString(): string;
 }

src/Token/InvalidTokenStructure.php

@@ -13,6 +13,16 @@ public static function missingOrNotEnoughSeparators(): self
         return new self('The JWT string must have two dots');
     }
 
+    public static function missingHeaderPart(): self
+    {
+        return new self('The JWT string is missing the Header part');
+    }
+
+    public static function missingClaimsPart(): self
+    {
+        return new self('The JWT string is missing the Claim part');
+    }
+
     public static function arrayExpected(string $part): self
     {
         return new self($part . ' must be an array');

src/Token/Parser.php

@@ -27,6 +27,14 @@ public function parse(string $jwt): TokenInterface
     {
         [$encodedHeaders, $encodedClaims, $encodedSignature] = $this->splitJwt($jwt);
 
+        if ($encodedHeaders === '') {
+            throw InvalidTokenStructure::missingHeaderPart();
+        }
+
+        if ($encodedClaims === '') {
+            throw InvalidTokenStructure::missingClaimsPart();
+        }
+
         $header = $this->parseHeader($encodedHeaders);
 
         return new Plain(
@@ -39,6 +47,8 @@ public function parse(string $jwt): TokenInterface
     /**
      * Splits the JWT string into an array
      *
+     * @param non-empty-string $jwt
+     *
      * @return string[]
      *
      * @throws InvalidTokenStructure When JWT doesn't have all parts.
@@ -57,6 +67,8 @@ private function splitJwt(string $jwt): array
     /**
      * Parses the header from a string
      *
+     * @param non-empty-string $data
+     *
      * @return mixed[]
      *
      * @throws UnsupportedHeaderFound When an invalid header is informed.
@@ -84,6 +96,8 @@ private function parseHeader(string $data): array
     /**
      * Parses the claim set from a string
      *
+     * @param non-empty-string $data
+     *
      * @return mixed[]
      *
      * @throws InvalidTokenStructure When parsed content isn't an array or contains non-parseable dates.

src/UnencryptedToken.php

@@ -20,6 +20,8 @@ public function signature(): Signature;
 
     /**
      * Returns the token payload
+     *
+     * @return non-empty-string
      */
     public function payload(): string;
 }

test/functional/MaliciousTamperingPreventionTest.php

@@ -106,6 +106,7 @@ public function preventRegressionsThatAllowsMaliciousTampering(): void
         );
     }
 
+    /** @return non-empty-string */
     private function createMaliciousToken(string $token): string
     {
         $dec     = new JoseEncoder();

test/functional/RFC6978VectorTest.php

@@ -34,6 +34,8 @@ final class RFC6978VectorTest extends TestCase
      * @covers \Lcobucci\JWT\Signer\Ecdsa\Sha384
      * @covers \Lcobucci\JWT\Signer\Ecdsa\Sha512
      * @covers \Lcobucci\JWT\Signer\OpenSSL
+     *
+     * @param non-empty-string $payload
      */
     public function theVectorsFromRFC6978CanBeVerified(
         Ecdsa $signer,

test/unit/JwtFacadeTest.php

@@ -56,6 +56,7 @@ protected function setUp(): void
         $this->issuer = 'bar';
     }
 
+    /** @return non-empty-string */
     private function createToken(): string
     {
         return (new JwtFacade(clock: $this->clock))->issue(