From c1a9e705604f3d35a6dc24318f99f3c381b2c82a Mon Sep 17 00:00:00 2001
From: Mark Paluch <mpaluch@pivotal.io>
Date: Tue, 20 Mar 2018 13:03:26 +0100
Subject: [PATCH] Allow empty plaintext for transit encryption.

We now allow construction and encryption of empty Plaintext objects. Empty plaintext can make sense from a security perspective.

Closes gh-223.
---
 .../vault/support/Plaintext.java               | 10 ++++------
 .../VaultTransitTemplateIntegrationTests.java  | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/Plaintext.java b/spring-vault-core/src/main/java/org/springframework/vault/support/Plaintext.java
index 20d85ae9..a3d843d8 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/support/Plaintext.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/support/Plaintext.java
@@ -18,7 +18,6 @@ package org.springframework.vault.support;
 import lombok.EqualsAndHashCode;
 
 import org.springframework.util.Assert;
-import org.springframework.util.ObjectUtils;
 
 /**
  * Value object representing plaintext with an optional {@link VaultTransitContext}.
@@ -44,13 +43,12 @@ public class Plaintext {
 	/**
 	 * Factory method to create {@link Plaintext} from a byte sequence.
 	 *
-	 * @param plaintext the plaintext to encrypt, must not be {@literal null} or empty.
+	 * @param plaintext the plaintext to encrypt, must not be {@literal null}.
 	 * @return the {@link Plaintext} for {@code plaintext}.
 	 */
 	public static Plaintext of(byte[] plaintext) {
 
-		Assert.isTrue(!ObjectUtils.isEmpty(plaintext),
-				"Plaintext must not be null or empty");
+		Assert.notNull(plaintext, "Plaintext must not be null");
 
 		return new Plaintext(plaintext, null);
 	}
@@ -60,12 +58,12 @@ public class Plaintext {
 	 * {@link String} is encoded to {@code byte} using the default
 	 * {@link java.nio.charset.Charset}.
 	 *
-	 * @param plaintext the plaintext to encrypt, must not be {@literal null} or empty.
+	 * @param plaintext the plaintext to encrypt, must not be {@literal null}.
 	 * @return the {@link Plaintext} for {@code plaintext}.
 	 */
 	public static Plaintext of(String plaintext) {
 
-		Assert.hasText(plaintext, "Plaintext must not be null or empty");
+		Assert.notNull(plaintext, "Plaintext must not be null");
 
 		return of(plaintext.getBytes());
 	}
diff --git a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java
index 38232391..da114885 100644
--- a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java
+++ b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java
@@ -246,6 +246,24 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport
 		assertThat(ciphertext).startsWith("vault:v1:");
 	}
 
+	@Test
+	public void encryptShouldEncryptEmptyValues() {
+
+		transitOperations.createKey("mykey", VaultTransitKeyCreationRequest.builder()
+				.convergentEncryption(true).derived(true).build());
+
+		VaultTransitContext context = VaultTransitContext.builder()
+				.context("blubb".getBytes()) //
+				.nonce("123456789012".getBytes()) //
+				.build();
+
+		Ciphertext ciphertext = transitOperations.encrypt("mykey",
+				Plaintext.of("").with(context));
+
+		assertThat(ciphertext.getCiphertext()).startsWith("vault:v1:");
+		assertThat(ciphertext.getContext()).isEqualTo(context);
+	}
+
 	@Test
 	public void encryptShouldCreateWrappedCiphertextWithNonceAndContext() {