JSON-RPC error responses leak exception stack traces and absolute build paths in error.data

[stdevMac]

Description

When a JSON-RPC call fails with -32603 Internal error, the error.data member carries the raw Exception.ToString() — the exception type, its message, and the full managed stack trace including absolute source paths from the build machine. This is returned to any caller that can reach the RPC port, including an unauthenticated one.

Steps to Reproduce

1. Start a node with the JSON-RPC interface enabled.
2. Trigger any internal error, for example an empty string for a required non-nullable parameter:

curl -s -X POST -H 'Content-Type: application/json' http://localhost:8545 -d \
  '{"jsonrpc":"2.0","method":"eth_getBlockByNumber","params":["",false],"id":1}'

Actual behavior

error.data contains the exception dump:

{"jsonrpc":"2.0","error":{"code":-32603,"message":"Internal error",
 "data":"System.NullReferenceException: Object reference not set to an instance of an object.\n   at Nethermind.JsonRpc.Modules.Eth.EthRpcModule.GetBlock(BlockParameter blockParameter, Boolean returnFullTransactionObjects) in /src/Nethermind/Nethermind.JsonRpc/Modules/Eth/EthRpcModule.cs:line 649\n   at ..."},"id":1}

Expected behavior

A stable, caller-safe message in error.data (or its omission), with the exception detail written to the node's own log instead. Internal implementation structure and build-machine paths should not be part of the wire response.

Additional context

There are five distinct sites that place exception text on the wire, not one, so a fix at a single place will leave the others open:

• JsonRpcService.cs:92 — the outer catch, reached on a path that the per-module tests do not exercise
• JsonRpcService.cs:550
• JsonRpcService.cs:567
• JsonRpcService.cs:587
• JsonRpcService.cs:617

Verified on master (b644740ec8) and 2.0.0-rc (e6d3d2f5ab).

#5880 is an older report of the same shape on trace_filter ('data': "System.ArgumentNullException: Value cannot be null."), which suggests this has been visible for a while as a per-method symptom rather than as the class it is.

Related: #13156 covers the same exception text being written to the operator's log at WARN for caller-fault errors.

Desktop

• Operating System: Linux x64
• Version: 2.0.0-rc (e6d3d2f5ab); also present on master (b644740ec8)
• Installation Method: Docker