fix: sanitize internal error messages in transport handlers by ez-lbz · Pull Request #1046 · a2aproject/a2a-java

ez-lbz · 2026-08-10T16:30:30Z

What changed

1. Sanitize internal error messages in the JSON-RPC handler

Problem: JSONRPCHandler converted every unexpected (non-A2AError) exception into new InternalError(t.getMessage()), forwarding the raw exception message — often containing file paths, library names, or class names — to the client in the JSON-RPC error payload (CWE-209, information disclosure / server fingerprinting).

Fix (transport/jsonrpc/src/main/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandler.java):

Added a LOGGER (java.util.logging) and a private internalError(Throwable) helper that logs the full exception server-side (Level.SEVERE) and returns new InternalError("Internal error") with a generic, client-safe message.
Replaced all 12 new InternalError(...getMessage()) sites (onMessageSend, onMessageSendStream, onSubscribeToTask, cancel/get/list tasks, push-notification config endpoints, extended agent card, and the streaming subscriber onError path).

Fix (transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java):

testOnMessageSendSanitizesUnexpectedException — a mocked RuntimeException with a sensitive message yields an InternalError whose message is "Internal error" and does not contain the sensitive text.

2. Sanitize internal error messages in the REST handler

Fix (transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java):

Added a private internalError(Throwable) helper (logs at SEVERE, returns new InternalError("Internal error")) and replaced all 13 new InternalError(...getMessage()) sites across send/cancel/get/list/subscribe/push-config/agent-card endpoints, including the streaming error paths.

Fix (transport/rest/src/test/java/org/a2aproject/sdk/transport/rest/handler/RestHandlerTest.java):

testSendMessageSanitizesInternalError — asserts a 500 response whose message is "Internal error" (no sensitive text leaked).

3. Sanitize internal error messages in the gRPC handler

Problem: GrpcHandler.handleInternalError sent t.getMessage() in the gRPC error description, leaking internal exception details to the client.

Fix (transport/grpc/src/main/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandler.java):

handleInternalError now logs the full exception at SEVERE and calls handleError with new InternalError("Internal error"), so the gRPC status description carries only the generic message.

Fix (transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java):

testOnMessageInternalErrorIsSanitized — a mocked RuntimeException yields gRPC INTERNAL with description "Internal error" (no sensitive text).

Note: exceptions that are already A2AError (including InternalError thrown by the request handler) still flow through unchanged — sanitization applies to unexpected non-A2A exceptions. The compat-0.3 module has its own copies of the handlers and was intentionally left unchanged (out of scope).

Testing

mvn -pl transport/jsonrpc,transport/grpc,transport/rest test — 127 tests run, 0 failures, 1 skipped (BUILD SUCCESS): JSON-RPC 49, gRPC 41, REST 37, including the 3 new sanitization regression tests.
mvn -pl reference/jsonrpc test — 198 tests run, 0 failures, 0 skipped (BUILD SUCCESS).

ehsavoie

There are still some InternalError leaking messages:

reference/jsonrpc/src/main/java/.../A2AServerRoutes.java:340 — new InternalError(t.getMessage())
reference/rest/src/main/java/.../A2AServerRoutes.java:309, 427, 461, 495, 605, 636, 681, 714 — new InternalError(t.getMessage())

ehsavoie · 2026-08-11T14:55:20Z

This should be sanitized s well

This isn't addressed

The reference JSON-RPC and REST route handlers still propagated the raw exception message to clients via new InternalError(t.getMessage()). Use the generic InternalError message and log the original throwable so server-side observability is preserved.

ez-lbz · 2026-08-11T15:08:55Z

Good catch — the transport handlers were fixed but the reference server routes were missed. All 9 remaining new InternalError(t.getMessage()) sites (1 in reference/jsonrpc, 8 in reference/rest) now use the generic InternalError("Internal error"), with the original throwable logged server-side.

Testing: reference/jsonrpc QuarkusA2AJSONRPCVertxTest 54 passed; reference/rest QuarkusA2ARestVertxTest 57 passed (9 skipped).

ehsavoie · 2026-08-12T08:23:59Z

This isn't addressed

ehsavoie · 2026-08-12T08:25:33Z

            error = new A2AErrorResponse(new JSONParseError(e.getMessage()));
        } catch (Throwable t) {
-            error = new A2AErrorResponse(new InternalError(t.getMessage()));
+            LOG.error("Failed to process request", t);


Maybe use the same message as in the handlers:
"Internal error while processing request"

ehsavoie · 2026-08-12T08:26:11Z

 import static org.a2aproject.sdk.transport.jsonrpc.context.JSONRPCContextKeys.HEADERS_KEY;
 import static org.a2aproject.sdk.transport.jsonrpc.context.JSONRPCContextKeys.METHOD_NAME_KEY;
 import static org.a2aproject.sdk.transport.jsonrpc.context.JSONRPCContextKeys.TENANT_KEY;
+import org.slf4j.Logger;


Maybe move this down after java imports

ehsavoie · 2026-08-12T08:26:19Z

            response = jsonRestHandler.sendMessage(context, extractTenant(rc), body);
        } catch (Throwable t) {
-            response = jsonRestHandler.createErrorResponse(new InternalError(t.getMessage()));
+            LOG.error("Failed to process request", t);


Maybe use the same message as in the handlers:
"Internal error while processing request"

ehsavoie · 2026-08-12T08:26:31Z

 import static org.a2aproject.sdk.transport.rest.context.RestContextKeys.METHOD_NAME_KEY;
 import static io.vertx.core.http.HttpHeaders.CONTENT_TYPE;
 import static jakarta.ws.rs.core.MediaType.APPLICATION_JSON;
+import org.slf4j.Logger;


Move this down after the java imports

ehsavoie · 2026-08-12T08:28:13Z

@ez-lbz some small fixes before I can merge

… messages - RestHandler: the response-serialization failure path leaked the InvalidProtocolBufferException message; sanitize it and log the throwable. - Reference JSON-RPC/REST routes now log the same message as the transport handlers ('Internal error while processing request') and place the slf4j imports after the java imports.

ez-lbz · 2026-08-12T13:56:27Z

All five points addressed:

RestHandler — the response-serialization failure path (createSuccessResponse) was still leaking the InvalidProtocolBufferException message; now sanitized to the generic internal error with the throwable logged.
Reference JSON-RPC/rest routes now log the same message as the transport handlers (Internal error while processing request), and the client-facing message stays the generic internal error.
slf4j imports moved after the java imports in both A2AServerRoutes files.

Testing: RestHandlerTest 37 passed; QuarkusA2AJSONRPCVertxTest 54 passed (one run had a transient failure that did not reproduce).

ez-lbz added 2 commits August 11, 2026 00:28

fix: sanitize internal error messages in transport handlers

8b6f40c

chore: remove internal tracking ids from comments

19fe9ee

ehsavoie requested changes Aug 11, 2026

View reviewed changes

ci: retrigger checks (flaky compat-0.3 resubscribe timeout)

1601794

ehsavoie requested changes Aug 12, 2026

View reviewed changes

Navigation Menu

Uh oh!

fix: sanitize internal error messages in transport handlers - #1046

fix: sanitize internal error messages in transport handlers #1046
ez-lbz wants to merge 5 commits into
a2aproject:mainfrom
ez-lbz:fix/internal-error-sanitization

ez-lbz commented Aug 10, 2026

Uh oh!

ehsavoie left a comment

Uh oh!

ehsavoie Aug 11, 2026

Uh oh!

ehsavoie Aug 12, 2026

Uh oh!

ez-lbz commented Aug 11, 2026

Uh oh!

ehsavoie Aug 12, 2026

Uh oh!

ehsavoie Aug 12, 2026

Uh oh!

ehsavoie Aug 12, 2026

Uh oh!

ehsavoie Aug 12, 2026

Uh oh!

ehsavoie Aug 12, 2026

Uh oh!

ehsavoie commented Aug 12, 2026

Uh oh!

ez-lbz commented Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ez-lbz commented Aug 10, 2026

What changed

1. Sanitize internal error messages in the JSON-RPC handler

2. Sanitize internal error messages in the REST handler

3. Sanitize internal error messages in the gRPC handler

Testing

Uh oh!

ehsavoie left a comment

Choose a reason for hiding this comment

Uh oh!

ehsavoie Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

ehsavoie Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

ez-lbz commented Aug 11, 2026

Uh oh!

ehsavoie Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

ehsavoie Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

ehsavoie Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

ehsavoie Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

ehsavoie Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

ehsavoie commented Aug 12, 2026

Uh oh!

ez-lbz commented Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants