fix: stop leaking exception messages to clients via JSON-RPC error data
Tool handler exceptions and anything reaching JsonRpcHandler's blind rescue had their #message echoed into the error data member, exposing internals to untrusted clients (CWE-209). Capability errors keep their client-facing message by re-raising through RequestHandlerError, the one channel whose message is deliberately surfaced. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
parent
d51d4a0f91
commit
f379e13b47
1 changed files with 23 additions and 14 deletions
|
|
@ -545,7 +545,7 @@ module MCP
|
|||
assert_nil response[:result]
|
||||
assert_equal(-32603, response[:error][:code])
|
||||
assert_equal "Internal error", response[:error][:message]
|
||||
assert_match(/Internal error calling tool tool_with_required_context: /, response[:error][:data])
|
||||
assert_equal "Internal error calling tool tool_with_required_context", response[:error][:data]
|
||||
end
|
||||
|
||||
test "call_tool_with_args correctly detects server_context parameter presence" do
|
||||
|
|
|
|||
Loading…
Reference in a new issue