The problem could not in the assertion, but in the Arrange or Act part of the testcase: when you unit-test, you invoke a [small] piece of code in a controlled environment. That is to say that you should know how the software under test will behave, and thus, know whether it will return a null pointer, or an empty string. Every test shall have one expected result.
... Unless you're using your test against several functions/methods that behave differently, or some third-party code that appears to behave differently in different situations.
If this is the case, the "One assertion per rule" is just a guideline, and you can use the assertion as shown is the question. If this test fails, it will mean that the returned foo is a non-empty string.
Or, you could create a function to test for empty strings that will also test if the string pointer is not null:
Assert(is_empty_string(foo));
Your language string class may provide this method.