Fix null expected value throwing NullPointerException in JWTVerifier

Registering a null expected value (e.g. withSubject(null), withJWTId(null),
withClaim(name, (Integer) null)) documents the intent "this claim must be JSON
null". When the token actually carried the claim, verifyNull() returned false and
the code then called value.equals(claim.asX()) on the null expected value, leaking
a raw NullPointerException out of verify() instead of the documented
IncorrectClaimException.

Use the null-safe Objects.equals(value, claim.asX()) at every value-claim site
(withSubject, withJWTId, the typed withClaim overloads, and the Instant overload,
which withClaim(Date) delegates to). Behaviour is identical when the value is
non-null; when it is null and the claim is present, verification now fails with
IncorrectClaimException. No public API change.

Author: asim-alam

lib/src/main/java/com/auth0/jwt/JWTVerifier.java

@@ -90,7 +90,7 @@ public Verification withIssuer(String... issuer) {
         @Override
         public Verification withSubject(String subject) {
             addCheck(RegisteredClaims.SUBJECT, (claim, decodedJWT) ->
-                    verifyNull(claim, subject) || subject.equals(claim.asString()));
+                    verifyNull(claim, subject) || Objects.equals(subject, claim.asString()));
             return this;
         }
 
@@ -163,7 +163,7 @@ public Verification ignoreIssuedAt() {
         @Override
         public Verification withJWTId(String jwtId) {
             addCheck(RegisteredClaims.JWT_ID, ((claim, decodedJWT) ->
-                    verifyNull(claim, jwtId) || jwtId.equals(claim.asString())));
+                    verifyNull(claim, jwtId) || Objects.equals(jwtId, claim.asString())));
             return this;
         }
 
@@ -186,39 +186,39 @@ public Verification withNullClaim(String name) throws IllegalArgumentException {
         public Verification withClaim(String name, Boolean value) throws IllegalArgumentException {
             assertNonNull(name);
             addCheck(name, ((claim, decodedJWT) -> verifyNull(claim, value)
-                    || value.equals(claim.asBoolean())));
+                    || Objects.equals(value, claim.asBoolean())));
             return this;
         }
 
         @Override
         public Verification withClaim(String name, Integer value) throws IllegalArgumentException {
             assertNonNull(name);
             addCheck(name, ((claim, decodedJWT) -> verifyNull(claim, value)
-                    || value.equals(claim.asInt())));
+                    || Objects.equals(value, claim.asInt())));
             return this;
         }
 
         @Override
         public Verification withClaim(String name, Long value) throws IllegalArgumentException {
             assertNonNull(name);
             addCheck(name, ((claim, decodedJWT) -> verifyNull(claim, value)
-                    || value.equals(claim.asLong())));
+                    || Objects.equals(value, claim.asLong())));
             return this;
         }
 
         @Override
         public Verification withClaim(String name, Double value) throws IllegalArgumentException {
             assertNonNull(name);
             addCheck(name, ((claim, decodedJWT) -> verifyNull(claim, value)
-                    || value.equals(claim.asDouble())));
+                    || Objects.equals(value, claim.asDouble())));
             return this;
         }
 
         @Override
         public Verification withClaim(String name, String value) throws IllegalArgumentException {
             assertNonNull(name);
             addCheck(name, ((claim, decodedJWT) -> verifyNull(claim, value)
-                    || value.equals(claim.asString())));
+                    || Objects.equals(value, claim.asString())));
             return this;
         }
 
@@ -234,7 +234,7 @@ public Verification withClaim(String name, Instant value) throws IllegalArgument
             // we need to compare them with only seconds-granularity
             addCheck(name,
                     ((claim, decodedJWT) -> verifyNull(claim, value)
-                            || value.truncatedTo(ChronoUnit.SECONDS).equals(claim.asInstant())));
+                            || (value != null && value.truncatedTo(ChronoUnit.SECONDS).equals(claim.asInstant()))));
             return this;
         }
 

lib/src/test/java/com/auth0/jwt/JWTVerifierTest.java

@@ -1314,4 +1314,15 @@ public void shouldCheckForWrongIntegerArrayClaim() {
         });
         assertThat(e.getClaimName(), is("custom"));
     }
+
+    @Test
+    public void shouldThrowIncorrectClaimNotNpeWhenNullSubjectExpectedButClaimPresent() {
+        // H4: registering a null expected value means "the claim must be JSON null"; when the token
+        // actually carries the claim, verification must fail with the documented IncorrectClaimException,
+        // not leak a raw NullPointerException out of verify().
+        String token = JWT.create().withSubject("actual").sign(Algorithm.HMAC256("secret"));
+        IncorrectClaimException e = assertThrows(null, IncorrectClaimException.class, () ->
+                JWTVerifier.init(Algorithm.HMAC256("secret")).withSubject(null).build().verify(token));
+        assertThat(e.getClaimName(), is("sub"));
+    }
 }