feat(api): sanitize HTTP API error responses

framework/src/main/java/org/tron/core/services/http/GetBlockServlet.java

@@ -77,9 +77,7 @@ private void fillResponse(boolean visible, BlockReq request, HttpServletResponse
         response.getWriter().println("{}");
       }
     } catch (IllegalArgumentException e) {
-      JSONObject jsonObject = new JSONObject();
-      jsonObject.put("Error", e.getMessage());
-      response.getWriter().println(jsonObject.toJSONString());
+      Util.processError(e.getMessage(), response);
     }
   }
 

framework/src/main/java/org/tron/core/services/http/GetBrokerageServlet.java

@@ -1,6 +1,5 @@
 package org.tron.core.services.http;
 
-import java.io.IOException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
@@ -27,12 +26,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
       }
       response.getWriter().println("{\"brokerage\": " + value + "}");
     } catch (DecoderException | IllegalArgumentException e) {
-      try {
-        response.getWriter()
-            .println("{\"Error\": " + "\"INVALID address, " + e.getMessage() + "\"}");
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(Util.INVALID_ADDRESS_MSG, response);
     } catch (Exception e) {
       Util.processError(e, response);
     }

framework/src/main/java/org/tron/core/services/http/GetBurnTrxServlet.java

@@ -1,6 +1,5 @@
 package org.tron.core.services.http;
 
-import java.io.IOException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
@@ -24,12 +23,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
           : "{\"burnTrxAmount\": " + value + "}";
       response.getWriter().println(out);
     } catch (Exception e) {
-      logger.error("", e);
-      try {
-        response.getWriter().println(Util.printErrorMsg(e));
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(e, response);
     }
   }
 

framework/src/main/java/org/tron/core/services/http/GetNodeInfoServlet.java

@@ -1,6 +1,5 @@
 package org.tron.core.services.http;
 
-import java.io.IOException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
@@ -24,12 +23,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
       response.getWriter().println(JSON.toJSONString(nodeInfo));
 
     } catch (Exception e) {
-      logger.error("", e);
-      try {
-        response.getWriter().println(Util.printErrorMsg(e));
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(e, response);
     }
   }
 

framework/src/main/java/org/tron/core/services/http/GetPendingSizeServlet.java

@@ -1,6 +1,5 @@
 package org.tron.core.services.http;
 
-import java.io.IOException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
@@ -24,12 +23,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
           : "{\"pendingSize\": " + value + "}";
       response.getWriter().println(out);
     } catch (Exception e) {
-      logger.error("", e);
-      try {
-        response.getWriter().println(Util.printErrorMsg(e));
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(e, response);
     }
   }
 

framework/src/main/java/org/tron/core/services/http/GetRewardServlet.java

@@ -1,6 +1,5 @@
 package org.tron.core.services.http;
 
-import java.io.IOException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
@@ -29,19 +28,9 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
           : "{\"reward\": " + value + "}";
       response.getWriter().println(out);
     } catch (DecoderException | IllegalArgumentException e) {
-      try {
-        response.getWriter()
-            .println("{\"Error\": " + "\"INVALID address, " + e.getMessage() + "\"}");
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(Util.INVALID_ADDRESS_MSG, response);
     } catch (Exception e) {
-      logger.error("", e);
-      try {
-        response.getWriter().println(Util.printErrorMsg(e));
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(e, response);
     }
   }
 

framework/src/main/java/org/tron/core/services/http/GetTransactionInfoByBlockNumServlet.java

@@ -1,6 +1,5 @@
 package org.tron.core.services.http;
 
-import java.io.IOException;
 import java.util.List;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -52,12 +51,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
         response.getWriter().println("{}");
       }
     } catch (Exception e) {
-      logger.debug("Exception: {}", e.getMessage());
-      try {
-        response.getWriter().println(Util.printErrorMsg(e));
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(e, response);
     }
   }
 
@@ -75,12 +69,7 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
         response.getWriter().println("{}");
       }
     } catch (Exception e) {
-      logger.debug("Exception: {}", e.getMessage());
-      try {
-        response.getWriter().println(Util.printErrorMsg(e));
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(e, response);
     }
   }
 }

framework/src/main/java/org/tron/core/services/http/RateLimiterServlet.java

@@ -131,8 +131,7 @@ protected void service(HttpServletRequest req, HttpServletResponse resp)
         super.service(req, resp);
         Metrics.histogramObserve(requestTimer);
       } else {
-        resp.getWriter()
-            .println(Util.printErrorMsg(new IllegalAccessException("lack of computing resources")));
+        Util.processError(Util.RATE_LIMITER_ERROR_MSG, resp);
       }
     } catch (ServletException | IOException | BadMessageException e) {
       throw e;

framework/src/main/java/org/tron/core/services/http/Util.java

@@ -48,6 +48,8 @@
 import org.tron.core.capsule.TransactionCapsule;
 import org.tron.core.config.args.Args;
 import org.tron.core.db.TransactionTrace;
+import org.tron.core.exception.ContractValidateException;
+import org.tron.core.exception.MaintenanceUnavailableException;
 import org.tron.core.services.http.JsonFormat.ParseException;
 import org.tron.json.JSON;
 import org.tron.json.JSONArray;
@@ -65,6 +67,10 @@
 @Slf4j(topic = "API")
 public class Util {
 
+  private static final String INTERNAL_SERVER_ERROR = "internal server error";
+  public static final String RATE_LIMITER_ERROR_MSG = "lack of computing resources";
+  static final String INVALID_ADDRESS_MSG = "INVALID address";
+
   public static final String EVENTS_DEPRECATED_MSG =
       "'events' field is deprecated and no longer supported";
 
@@ -114,12 +120,35 @@ public static String printTransactionFee(String transactionFee) {
     return jsonObject.toJSONString();
   }
 
-  public static String printErrorMsg(Exception e) {
+  public static String printErrorMsg(String msg) {
     JSONObject jsonObject = new JSONObject();
-    jsonObject.put("Error", e.getClass() + " : " + e.getMessage());
+    jsonObject.put("Error", msg);
     return jsonObject.toJSONString();
   }
 
+  private static String clientMessage(Exception e) {
+    if (e == null) {
+      return INTERNAL_SERVER_ERROR;
+    }
+
+    Class<?> type = e.getClass();
+    if (type == IllegalAccessException.class) {
+      return RATE_LIMITER_ERROR_MSG.equals(e.getMessage())
+          ? RATE_LIMITER_ERROR_MSG : INTERNAL_SERVER_ERROR;
+    }
+    if (type == IllegalArgumentException.class) {
+      return EVENTS_DEPRECATED_MSG.equals(e.getMessage())
+          ? EVENTS_DEPRECATED_MSG : INTERNAL_SERVER_ERROR;
+    }
+    if (type == ParseException.class
+        || type == ContractValidateException.class
+        || type == MaintenanceUnavailableException.class) {
+      String message = e.getMessage();
+      return StringUtils.isBlank(message) ? INTERNAL_SERVER_ERROR : message;
+    }
+    return INTERNAL_SERVER_ERROR;
+  }
+
   public static String printBlockList(BlockList list, boolean selfType) {
     List<Block> blocks = list.getBlockList();
     JSONObject jsonObject = new JSONObject();
@@ -526,11 +555,16 @@ public static String getMemo(byte[] memo) {
   }
 
   public static void processError(Exception e, HttpServletResponse response) {
-    logger.debug(e.getMessage(), e);
+    logger.debug("HTTP request failed", e);
+    processError(clientMessage(e), response);
+  }
+
+  // Bypasses clientMessage: callers must pass audited fixed or pre-existing client texts only.
+  static void processError(String msg, HttpServletResponse response) {
     try {
-      response.getWriter().println(Util.printErrorMsg(e));
+      response.getWriter().println(Util.printErrorMsg(msg));
     } catch (IOException ioe) {
-      logger.debug("IOException: {}", ioe.getMessage());
+      logger.debug("Failed to write HTTP error response", ioe);
     }
   }
 

framework/src/main/java/org/tron/core/services/http/ValidateAddressServlet.java

@@ -47,7 +47,7 @@ private String validAddress(String input) {
       }
     } catch (Exception e) {
       result = false;
-      msg = e.getMessage();
+      msg = "Invalid address";
     }
 
     JSONObject jsonAddress = new JSONObject();

framework/src/main/java/org/tron/core/services/http/solidity/GetTransactionByIdSolidityServlet.java

@@ -30,12 +30,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
       String input = request.getParameter("value");
       fillResponse(ByteString.copyFrom(ByteArray.fromHexString(input)), visible, response);
     } catch (Exception e) {
-      logger.debug("Exception: {}", e.getMessage());
-      try {
-        response.getWriter().println(e.getMessage());
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(e, response);
     }
   }
 
@@ -46,12 +41,7 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
       JsonFormat.merge(params.getParams(), build, params.isVisible());
       fillResponse(build.build().getValue(), params.isVisible(), response);
     } catch (Exception e) {
-      logger.debug("Exception: {}", e.getMessage());
-      try {
-        response.getWriter().println(e.getMessage());
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(e, response);
     }
   }
 

framework/src/main/java/org/tron/core/services/http/solidity/GetTransactionInfoByIdSolidityServlet.java

@@ -1,7 +1,6 @@
 package org.tron.core.services.http.solidity;
 
 import com.google.protobuf.ByteString;
-import java.io.IOException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
@@ -37,12 +36,7 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
         response.getWriter().println(JsonFormat.printToString(transInfo, visible));
       }
     } catch (Exception e) {
-      logger.debug("Exception: {}", e.getMessage());
-      try {
-        response.getWriter().println(e.getMessage());
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(e, response);
     }
   }
 
@@ -60,12 +54,7 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
         response.getWriter().println(JsonFormat.printToString(transInfo, params.isVisible()));
       }
     } catch (Exception e) {
-      logger.debug("Exception: {}", e.getMessage());
-      try {
-        response.getWriter().println(e.getMessage());
-      } catch (IOException ioe) {
-        logger.debug("IOException: {}", ioe.getMessage());
-      }
+      Util.processError(e, response);
     }
   }
 

framework/src/test/java/org/tron/core/services/http/BroadcastServletTest.java

@@ -156,7 +156,7 @@ public void doPostTest() throws IOException {
     while ((text = bufferedReader.readLine()) != null) {
       sb.append(text);
     }
-    Assert.assertTrue(sb.toString().contains("null"));
+    Assert.assertTrue(sb.toString().contains("{\"Error\":\"internal server error\"}"));
     httpUrlConnection.disconnect();
   }
 }