fix: sanitize internal error messages in transport handlers

[ez-lbz]

What changed

1. Sanitize internal error messages in the JSON-RPC handler

Problem: JSONRPCHandler converted every unexpected (non-A2AError) exception into new InternalError(t.getMessage()), forwarding the raw exception message — often containing file paths, library names, or class names — to the client in the JSON-RPC error payload (CWE-209, information disclosure / server fingerprinting).

Fix (transport/jsonrpc/src/main/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandler.java):

• Added a LOGGER (java.util.logging) and a private internalError(Throwable) helper that logs the full exception server-side (Level.SEVERE) and returns new InternalError("Internal error") with a generic, client-safe message.
• Replaced all 12 new InternalError(...getMessage()) sites (onMessageSend, onMessageSendStream, onSubscribeToTask, cancel/get/list tasks, push-notification config endpoints, extended agent card, and the streaming subscriber onError path).

Fix (transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java):

• testOnMessageSendSanitizesUnexpectedException — a mocked RuntimeException with a sensitive message yields an InternalError whose message is "Internal error" and does not contain the sensitive text.

2. Sanitize internal error messages in the REST handler

Fix (transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java):

• Added a private internalError(Throwable) helper (logs at SEVERE, returns new InternalError("Internal error")) and replaced all 13 new InternalError(...getMessage()) sites across send/cancel/get/list/subscribe/push-config/agent-card endpoints, including the streaming error paths.

Fix (transport/rest/src/test/java/org/a2aproject/sdk/transport/rest/handler/RestHandlerTest.java):

• testSendMessageSanitizesInternalError — asserts a 500 response whose message is "Internal error" (no sensitive text leaked).

3. Sanitize internal error messages in the gRPC handler

Problem: GrpcHandler.handleInternalError sent t.getMessage() in the gRPC error description, leaking internal exception details to the client.

Fix (transport/grpc/src/main/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandler.java):

• handleInternalError now logs the full exception at SEVERE and calls handleError with new InternalError("Internal error"), so the gRPC status description carries only the generic message.

Fix (transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java):

• testOnMessageInternalErrorIsSanitized — a mocked RuntimeException yields gRPC INTERNAL with description "Internal error" (no sensitive text).

Note: exceptions that are already A2AError (including InternalError thrown by the request handler) still flow through unchanged — sanitization applies to unexpected non-A2A exceptions. The compat-0.3 module has its own copies of the handlers and was intentionally left unchanged (out of scope).

Testing

• mvn -pl transport/jsonrpc,transport/grpc,transport/rest test — 127 tests run, 0 failures, 1 skipped (BUILD SUCCESS): JSON-RPC 49, gRPC 41, REST 37, including the 3 new sanitization regression tests.
• mvn -pl reference/jsonrpc test — 198 tests run, 0 failures, 0 skipped (BUILD SUCCESS).