[Bug]: Internal error messages leak into responses

Find where JSON RPC error responses are assembled, likely in a server error handler or middleware. Look for exception catching and the construction of the error object. The example shows a SQLAlchemy/postgres error, so trace the flow from database exceptions to the client. Check if there's existing error mapping or a place to add sanitization. Test by triggering an error with a long context ID and verifying the response no longer leaks internal details.

What happened?

When a server raises an exception, such as when supplying a context ID that is > 36 chars, the client receives a JSON RPC error object which includes the full internal error message that the server produced.

This is not good security practice to leak internal error messages like this, and could expose sensitive information.

A suggestion would be to redact any internal error messages, and perhaps create a mapping of common errors to client friendly error messages.

If the intention is for implementations to handle this themselves, with patching or intercepting, which is likely what we will be doing, it should be at least documented.

Relevant log output

Actual response received:

{'error': {'code': -32603, 'message': '(sqlalchemy.dialects.postgresql.asyncpg.Error) <class \'asyncpg.exceptions.StringDataRightTruncationError\'>: value too long for type character varying(36)\n[SQL: INSERT INTO tasks (id, context_id, kind, owner, last_updated, status, artifacts, history, protocol_version, metadata) VALUES ($1::VARCHAR, $2::VARCHAR, $3::VARCHAR, $4::VARCHAR, $5::TIMESTAMP WITHOUT TIME ZONE, $6::JSON, $7::JSON, $8::JSON, $9::VARCHAR, $10::JSON)]\n[parameters: (\'2deb8a1b-a091-4388-a7c2-832e579f6ba6\', \'21198763-5774-4cfd-a1da-883d915260ee999999999\', \'task\', \'\', None, \'{"state": "TASK_STATE_SUBMITTED"}\', \'[]\', \'[{"messageId": "e0f25133-9dcf-4cb9-9c32-e1cd63e3eee0", "contextId": "21198763-5774-4cfd-a1da-883d915260ee999999999", "taskId": "2deb8a1b-a091-4388-a7c2-832e579f6ba6", "role": "ROLE_USER", "parts": [{"text": "How\\\'s the weather in London?"}]}]\', \'1.0\', \'null\')]\n(Background on this error at: https://sqlalche.me/e/20/dbapi)'}, 'id': '19783034-a4f6-4a3f-b772-b004eb4b5cc7', 'jsonrpc': '2.0'}

Suggested response:

{'error': {'code': -32603, 'message': 'Context ID too long, must be <=36 chars.'}, 'id': '19783034-a4f6-4a3f-b772-b004eb4b5cc7', 'jsonrpc': '2.0'}

Or:

{'error': {'code': -32603, 'message': 'Server Error'}, 'id': '19783034-a4f6-4a3f-b772-b004eb4b5cc7', 'jsonrpc': '2.0'}

Code of Conduct

• I agree to follow this project's Code of Conduct