Prevent exposure of exception details to clients.

Closes GH-2571.

Author: christophstrobl

spring-data-rest-tests/spring-data-rest-tests-core/src/test/java/org/springframework/data/rest/tests/AbstractWebIntegrationTests.java

@@ -20,7 +20,6 @@
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
 
-import io.micrometer.observation.ObservationRegistry;
 import jakarta.servlet.Filter;
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
@@ -129,13 +128,13 @@ protected MockHttpServletResponse putAndGet(Link link, Object payload, MediaType
 		return StringUtils.hasText(response.getContentAsString()) ? response : client.request(link);
 	}
 
-	protected MockHttpServletResponse putOnlyExpect5XXStatus(Link link, Object payload, MediaType mediaType)
+	protected MockHttpServletResponse putOnlyExpect4XXStatus(Link link, Object payload, MediaType mediaType)
 			throws Exception {
 
 		String href = link.isTemplated() ? link.expand().getHref() : link.getHref();
 
 		MockHttpServletResponse response = mvc.perform(put(href).content(payload.toString()).contentType(mediaType))//
-				.andExpect(status().is5xxServerError())//
+				.andExpect(status().is4xxClientError())//
 				.andReturn().getResponse();
 
 		return StringUtils.hasText(response.getContentAsString()) ? response : client.request(link);

spring-data-rest-tests/spring-data-rest-tests-jpa/src/test/java/org/springframework/data/rest/webmvc/jpa/JpaWebTests.java

@@ -373,7 +373,7 @@ void associateTwoCreatorsToOrderWithSinglePut() throws Exception {
 		Link secondCreatorLink = preparePersonResource(new Person("Pippin", "Baggins"));
 		Link orderLinkToItsCreator = prepareOrderResource(new Order());
 
-		MockHttpServletResponse response = putOnlyExpect5XXStatus(orderLinkToItsCreator,
+		MockHttpServletResponse response = putOnlyExpect4XXStatus(orderLinkToItsCreator,
 				toUriList(firstCreatorLink, secondCreatorLink), TEXT_URI_LIST);
 		assertThat(response.getContentAsString()).contains("send only 1 link");
 	}

spring-data-rest-webmvc/src/main/java/org/springframework/data/rest/webmvc/InvalidStateTransitionRequest.java

@@ -0,0 +1,37 @@
+/*
+ * Copyright 2026-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.data.rest.webmvc;
+
+import org.springframework.util.Assert;
+
+class InvalidStateTransitionRequest extends RuntimeException {
+
+	private static final long serialVersionUID = -8496438973254611610L;
+
+	private final String message;
+
+	InvalidStateTransitionRequest(String message) {
+
+		Assert.hasText(message, "Message must not be null or empty!");
+
+		this.message = message;
+	}
+
+	@Override
+	public String getMessage() {
+		return message;
+	}
+}

spring-data-rest-webmvc/src/main/java/org/springframework/data/rest/webmvc/RepositoryPropertyReferenceController.java

@@ -283,7 +283,7 @@ public ResponseEntity<? extends RepresentationModel<?>> createPropertyReference(
 				}
 
 				if (!source.getLinks().hasSingleLink()) {
-					throw new IllegalArgumentException(
+					throw new InvalidStateTransitionRequest(
 							"Must send only 1 link to update a property reference that isn't a List or a Map.");
 				}
 
@@ -425,8 +425,8 @@ public ResponseEntity<Void> handle(HttpRequestMethodNotSupportedException except
 	}
 
 	/**
-	 * Custom {@link RepresentationModel} to be used with maps as {@link EntityModel} doesn't properly unwrap
-	 * {@link Map}s due to some limitation in Jackson.
+	 * Custom {@link RepresentationModel} to be used with maps as {@link EntityModel} doesn't properly unwrap {@link Map}s
+	 * due to some limitation in Jackson.
 	 *
 	 * @author Oliver Drotbohm
 	 * @see https://github.com/FasterXML/jackson-databind/issues/171

spring-data-rest-webmvc/src/main/java/org/springframework/data/rest/webmvc/RepositoryRestExceptionHandler.java

@@ -85,9 +85,17 @@ ResponseEntity<ExceptionMessage> handleNotReadable(HttpMessageNotReadableExcepti
 		return badRequest(new HttpHeaders(), o_O);
 	}
 
+	@ExceptionHandler
+	ResponseEntity<ExceptionMessage> handle(InvalidStateTransitionRequest o_O) {
+		return badRequest(new HttpHeaders(), o_O);
+	}
+
 	/**
 	 * Handle failures commonly thrown from code tries to read incoming data and convert or cast it to the right type by
-	 * returning {@code 500 Internal Server Error} and the thrown exception marshalled into JSON.
+	 * returning {@code 500 Internal Server Error}.
+	 * <p>
+	 * The raw exception message is not forwarded to the client to prevent leaking internal type names and input values.
+	 * The full exception is logged at WARN level for server-side diagnostics.
 	 *
 	 * @param o_O the exception to handle.
 	 * @return
@@ -96,7 +104,10 @@ ResponseEntity<ExceptionMessage> handleNotReadable(HttpMessageNotReadableExcepti
 			ConversionFailedException.class, NullPointerException.class })
 	ResponseEntity<ExceptionMessage> handleMiscFailures(Exception o_O) {
 
-		return errorResponse(HttpStatus.INTERNAL_SERVER_ERROR, new HttpHeaders(), o_O);
+		LOG.warn("Unexpected failure during request processing!", o_O);
+
+		return response(HttpStatus.INTERNAL_SERVER_ERROR, new HttpHeaders(),
+				new ExceptionMessage("Unexpected failure during request processing!"));
 	}
 
 	/**
@@ -120,7 +131,10 @@ ResponseEntity<RepositoryConstraintViolationExceptionMessage> handleRepositoryCo
 	 */
 	@ExceptionHandler({ OptimisticLockingFailureException.class, DataIntegrityViolationException.class })
 	ResponseEntity<ExceptionMessage> handleConflict(Exception o_O) {
-		return errorResponse(HttpStatus.CONFLICT, new HttpHeaders(), o_O);
+
+		LOG.warn("Could not commit changes!", o_O);
+
+		return response(HttpStatus.CONFLICT, new HttpHeaders(), new ExceptionMessage("Could not commit changes!"));
 	}
 
 	/**

spring-data-rest-webmvc/src/main/java/org/springframework/data/rest/webmvc/support/ExceptionMessage.java

@@ -1,27 +1,60 @@
 package org.springframework.data.rest.webmvc.support;
 
+import org.springframework.lang.Nullable;
+import org.springframework.util.Assert;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
 /**
  * A helper that renders an {@link Exception} JSON-friendly.
- * 
+ * <p>
+ * Only the outermost exception message is serialized into the HTTP response. The cause chain is accessible via
+ * {@link #getCause()} for server-side use but is excluded from JSON serialization to prevent leaking internals to
+ * clients.
+ *
  * @author Jon Brisbin
+ * @author Oliver Drotbohm
  */
 public class ExceptionMessage {
 
 	private final Throwable throwable;
+	private final String message;
 
 	public ExceptionMessage(Throwable throwable) {
+
+		Assert.notNull(throwable, "Throwable must not be null!");
+
 		this.throwable = throwable;
+		this.message = throwable.getMessage();
+	}
+
+	public ExceptionMessage(String message) {
+
+		Assert.notNull(message, "Message must not be null!");
+
+		this.message = message;
+		this.throwable = null;
 	}
 
 	@JsonProperty("message")
 	public String getMessage() {
-		return throwable.getMessage();
+		return message;
 	}
 
-	@JsonProperty("cause")
-	public ExceptionMessage getCause() {
-		return throwable.getCause() != null ? new ExceptionMessage(throwable.getCause()) : null;
+	@JsonIgnore
+	public @Nullable ExceptionMessage getCause() {
+
+		if (throwable == null) {
+			return null;
+		}
+
+		Throwable cause = throwable.getCause();
+
+		if (cause == null) {
+			return null;
+		}
+
+		return new ExceptionMessage(cause);
 	}
 }

spring-data-rest-webmvc/src/test/java/org/springframework/data/rest/webmvc/RepositoryRestExceptionHandlerUnitTests.java

@@ -20,12 +20,19 @@
 import ch.qos.logback.classic.Level;
 import ch.qos.logback.classic.Logger;
 
+import java.util.stream.Stream;
+
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 import org.slf4j.LoggerFactory;
 import org.springframework.context.support.StaticMessageSource;
+import org.springframework.core.convert.ConversionFailedException;
+import org.springframework.core.convert.TypeDescriptor;
 import org.springframework.dao.DataIntegrityViolationException;
+import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.data.rest.webmvc.support.ExceptionMessage;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
@@ -74,14 +81,41 @@ void handlesConflictCorrectly() {
 		assertThat(result.getStatusCode()).isEqualTo(HttpStatus.CONFLICT);
 	}
 
-	@Test // DATAREST-706
-	void forwardsExceptionForMiscellaneousFailure() {
+	static java.util.stream.Stream<Exception> conflictExceptions() {
+		return java.util.stream.Stream.of(
+				new DataIntegrityViolationException("could not execute statement",
+						new RuntimeException("Some message.")),
+				new OptimisticLockingFailureException("Some message."));
+	}
+
+	@ParameterizedTest // GH-2571
+	@MethodSource("conflictExceptions")
+	void conflictResponseHasExpectedStatusCode(Exception exception) {
+
+		ResponseEntity<ExceptionMessage> result = HANDLER.handleConflict(exception);
+
+		assertThat(result.getStatusCode()).isEqualTo(HttpStatus.CONFLICT);
+		assertThat(result.getBody()).isNotNull();
+		assertThat(result.getBody().getMessage()).doesNotContain("Some message.");
+	}
+
+	static Stream<Exception> miscExceptions() {
+		return Stream.of(
+				new IllegalArgumentException("Some message."),
+				new ClassCastException("Some message."),
+				new NullPointerException("Some message."),
+				new ConversionFailedException(TypeDescriptor.valueOf(String.class), TypeDescriptor.valueOf(Long.class),
+						"some-value", new RuntimeException("Some message.")));
+	}
 
-		String message = "My Message";
+	@ParameterizedTest // GH-2571
+	@MethodSource("miscExceptions")
+	void miscFailureResponseHasExpectedStatusCode(Exception exception) {
 
-		ResponseEntity<ExceptionMessage> result = HANDLER.handleMiscFailures(new Exception(message));
+		ResponseEntity<ExceptionMessage> result = HANDLER.handleMiscFailures(exception);
 
+		assertThat(result.getStatusCode()).isEqualTo(HttpStatus.INTERNAL_SERVER_ERROR);
 		assertThat(result.getBody()).isNotNull();
-		assertThat(result.getBody().getMessage()).isEqualTo(message);
+		assertThat(result.getBody().getMessage()).doesNotContain("Some message.");
 	}
 }