core: reject a JWK entry missing x5c when loading a SPIFFE trust bundle

core/src/main/java/io/grpc/internal/SpiffeUtil.java

@@ -232,7 +232,8 @@ private static List<X509Certificate> extractCert(List<Map<String, ?>> keysNode,
       checkJwkEntry(keyNode, trustDomainName);
       List<String> rawCerts = JsonUtil.getListOfStrings(keyNode, "x5c");
       if (rawCerts == null) {
-        break;
+        throw new IllegalArgumentException(String.format("'x5c' parameter is required. Certificate "
+            + "loading for trust domain '%s' failed.", trustDomainName));
       }
       if (rawCerts.size() != 1) {
         throw new IllegalArgumentException(String.format("Exactly 1 certificate is expected, but "

core/src/test/java/io/grpc/internal/SpiffeUtilTest.java

@@ -230,6 +230,7 @@ public static class CertificateApiTest {
     private static final String SPIFFE_TRUST_BUNDLE_DUPLICATES = "spiffebundle_duplicates.json";
     private static final String SPIFFE_TRUST_BUNDLE_WRONG_ROOT = "spiffebundle_wrong_root.json";
     private static final String SPIFFE_TRUST_BUNDLE_WRONG_SEQ = "spiffebundle_wrong_seq_type.json";
+    private static final String SPIFFE_TRUST_BUNDLE_MISSING_X5C = "spiffebundle_missing_x5c.json";
     private static final String DOMAIN_ERROR_MESSAGE =
         " Certificate loading for trust domain 'google.com' failed.";
 
@@ -351,6 +352,10 @@ public void loadTrustBundleFromFileFailureTest() {
       iae = assertThrows(IllegalArgumentException.class, () -> SpiffeUtil
           .loadTrustBundleFromFile(copyFileToTmp(SPIFFE_TRUST_BUNDLE_CORRUPTED_CERT)));
       assertEquals("Certificate can't be parsed." + DOMAIN_ERROR_MESSAGE, iae.getMessage());
+      // Check the exception if a key entry is missing the 'x5c' parameter
+      iae = assertThrows(IllegalArgumentException.class, () -> SpiffeUtil
+          .loadTrustBundleFromFile(copyFileToTmp(SPIFFE_TRUST_BUNDLE_MISSING_X5C)));
+      assertEquals("'x5c' parameter is required." + DOMAIN_ERROR_MESSAGE, iae.getMessage());
       // Check the exception if 'kty' value differs from 'RSA'
       iae = assertThrows(IllegalArgumentException.class, () -> SpiffeUtil
           .loadTrustBundleFromFile(copyFileToTmp(SPIFFE_TRUST_BUNDLE_WRONG_KTY)));

core/src/test/resources/io/grpc/internal/spiffebundle_missing_x5c.json

@@ -0,0 +1,12 @@
+{
+  "trust_domains": {
+    "google.com": {
+      "keys": [
+        {
+          "kty": "RSA",
+          "use": "x509-svid"
+        }
+      ]
+    }
+  }
+}