fix: stop leaking exception messages to clients via JSON-RPC error data

Tool handler exceptions and anything reaching JsonRpcHandler's blind
rescue had their #message echoed into the error data member, exposing
internals to untrusted clients (CWE-209). Capability errors keep their
client-facing message by re-raising through RequestHandlerError, the
one channel whose message is deliberately surfaced.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Joshua J 2026-08-06 17:47:56 +02:00
commit f379e13b47
No known key found for this signature in database

View file

@ -545,7 +545,7 @@ module MCP
assert_nil response[:result]
assert_equal(-32603, response[:error][:code])
assert_equal "Internal error", response[:error][:message]
assert_match(/Internal error calling tool tool_with_required_context: /, response[:error][:data])
assert_equal "Internal error calling tool tool_with_required_context", response[:error][:data]
end
test "call_tool_with_args correctly detects server_context parameter presence" do