fix(json-rpc): do not leak internal exception messages to clients

pi0 · claude · pi0 · commit ea2f2a32b88f · 2026-07-06T20:20:46.000Z
When a JSON-RPC method handler throws a non-HTTPError (an unexpected
internal exception), the raw error message was copied into the response
`data` field and returned to the caller, leaking internal details (DB
driver errors, file paths, etc.).

The unhandled branch now omits `data`, so clients receive only
`{ code: -32603, message: "Internal error" }`, consistent with
`HTTPError.toJSON()` masking `data`/`message` for unhandled errors.
Thrown `HTTPError`s still surface their opt-in `data`/`message`.

Co-Authored-By: Claude Fable 5 &lt;noreply@anthropic.com&gt;
diff --git a/src/utils/json-rpc.ts b/src/utils/json-rpc.ts
@@ -319,10 +319,11 @@ async function processJsonRpcMethod<C extends H3Event | WebSocketPeer>(
       : {
           status: 500,
           message: "Internal error",
-          data:
-            error_ != null && typeof error_ === "object" && "message" in error_
-              ? error_.message
-              : undefined,
+          // Never expose internal exception details to untrusted callers.
+          // Consistent with `HTTPError.toJSON()` hiding `data`/`message` for
+          // unhandled errors (see `src/error.ts`). Thrown `HTTPError`s keep
+          // their opt-in `data`/`message` via the branch above.
+          data: undefined,
         };
     const statusCode = h3Error.status;
     const statusMessage = h3Error.message;
diff --git a/test/json-rpc-ws.test.ts b/test/json-rpc-ws.test.ts
@@ -261,7 +261,7 @@ describe("defineJsonRpcWebSocketHandler", () => {
       expect(JSON.parse(sent[0])).toEqual({
         jsonrpc: "2.0",
         id: 4,
-        error: { code: -32_603, message: "Internal error", data: "Handler error" },
+        error: { code: -32_603, message: "Internal error" },
       });
     });
 
diff --git a/test/json-rpc.test.ts b/test/json-rpc.test.ts
@@ -31,6 +31,17 @@ describeMatrix("json-rpc", (t, { describe, it, expect }) => {
       errorPrimitive: () => {
         throw "Primitive error";
       },
+      // Simulates an unexpected internal exception whose message must not leak.
+      leaky: () => {
+        throw new Error("secret internal detail");
+      },
+      httpErrorWithData: () => {
+        throw new HTTPError({
+          status: 422,
+          message: "Validation failed",
+          data: { field: "email" },
+        });
+      },
       // "constructor" is a valid method name — the null-prototype map
       // ensures it doesn't resolve to Object.prototype.constructor.
       constructor: () => {
@@ -256,14 +267,58 @@ describeMatrix("json-rpc", (t, { describe, it, expect }) => {
       expect(json).toEqual({
         error: {
           code: -32_603,
-          data: "Handler error",
           message: "Internal error",
         },
         id: 4,
         jsonrpc: "2.0",
       });
     });
 
+    it("should not leak internal error details in error data", async () => {
+      t.app.post("/json-rpc", eventHandler);
+      const result = await t.fetch("/json-rpc", {
+        method: "POST",
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          method: "leaky",
+          id: 42,
+        }),
+      });
+      const json = await result.json();
+      // Unexpected internal exceptions must not surface their message to clients.
+      expect(json).toEqual({
+        error: {
+          code: -32_603,
+          message: "Internal error",
+        },
+        id: 42,
+        jsonrpc: "2.0",
+      });
+      expect(JSON.stringify(json)).not.toContain("secret internal detail");
+    });
+
+    it("should still surface data for thrown HTTPError (developer opt-in)", async () => {
+      t.app.post("/json-rpc", eventHandler);
+      const result = await t.fetch("/json-rpc", {
+        method: "POST",
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          method: "httpErrorWithData",
+          id: 43,
+        }),
+      });
+      const json = await result.json();
+      expect(json).toEqual({
+        error: {
+          code: -32_602,
+          data: { field: "email" },
+          message: "Validation failed",
+        },
+        id: 43,
+        jsonrpc: "2.0",
+      });
+    });
+
     it("should handle primitive thrown errors and map to JSON-RPC error", async () => {
       t.app.post("/json-rpc", eventHandler);
       const result = await t.fetch("/json-rpc", {
@@ -676,7 +731,6 @@ describeMatrix("json-rpc", (t, { describe, it, expect }) => {
         error: {
           code: -32_603,
           message: "Internal error",
-          data: "Handler error",
         },
       });
     });
