Description: The new fallback/exception paths embed the entire remote response (via response::toString)
and include remote-provided fields (message, error) in exception messages, which can leak
sensitive data (e.g., session IDs, capabilities, tokens, internal URLs) into logs or error
reporting when these exceptions are propagated/recorded.
ErrorCodec.java [151-172]

  throw new InvalidResponseException("missing \"value\" field", response);
}

Map<?, ?> value = (Map<?, ?>) response.get("value");

Object error = requireNonNullElse(value.get("error"), "");
Object message = requireNonNullElseGet(value.get("message"), response::toString);

if (!(error instanceof String)) {
  throw new InvalidResponseException("\"error\" field must be a string", response);
}
if (!(message instanceof String)) {
  throw new InvalidResponseException("\"message\" field must be a string", response);
}

Optional<W3CError<? extends WebDriverException>> w3CError =
    ERRORS.stream().filter(err -> error.equals(err.w3cErrorString)).findFirst();
if (w3CError.isPresent()) {
  return w3CError.get().exceptionConstructor.apply((String) message);
}
String extendedMessage = String.format("%s (error code: \"%s\")", message, error);


 ... (clipped 1 lines)

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status:
Sensitive data exposure: The exception message embeds the full response map (and may also embed it via fallback
response::toString), which can leak sensitive remote/server details to callers.

public InvalidResponseException(String message, Map<String, Object> response) {
  super(String.format("%s: %s%nSee %s", message, response, w3cErrorFormat));
}

Learn more about managing compliance generic rules or creating your own custom rules

When the "message" field is missing, use the string representation of the inner
value map for the fallback message instead of the entire response map.

java/src/org/openqa/selenium/remote/ErrorCodec.java [157]

-Object message = requireNonNullElseGet(value.get("message"), response::toString);
+Object message = requireNonNullElseGet(value.get("message"), () -> String.valueOf(value));

• Apply / Chat

Avoid embedding the full raw response map in the exception message; instead
include a bounded/sanitized representation (e.g., only top-level keys or a
truncated string) to reduce risk from untrusted remote data.

java/src/org/openqa/selenium/remote/InvalidResponseException.java [27-29]

 public InvalidResponseException(String message, Map<String, Object> response) {
-  super(String.format("%s: %s%nSee %s", message, response, w3cErrorFormat));
+  String responseSummary = String.valueOf(response.keySet());
+  super(String.format("%s: keys=%s%nSee %s", message, responseSummary, w3cErrorFormat));
 }

[To ensure code accuracy, apply this suggestion manually]

Add a check for an empty error string to avoid appending (error code: "") to the
exception message, returning a cleaner message instead.

java/src/org/openqa/selenium/remote/ErrorCodec.java [156-172]

-Object error = requireNonNullElse(value.get("error"), "");
-Object message = requireNonNullElseGet(value.get("message"), response::toString);
+Object errorObj = requireNonNullElse(value.get("error"), "");
+Object messageObj = requireNonNullElseGet(value.get("message"), response::toString);
 
-if (!(error instanceof String)) {
+if (!(errorObj instanceof String)) {
   throw new InvalidResponseException("\"error\" field must be a string", response);
 }
-if (!(message instanceof String)) {
+if (!(messageObj instanceof String)) {
   throw new InvalidResponseException("\"message\" field must be a string", response);
+}
+
+String error = (String) errorObj;
+String message = (String) messageObj;
+
+if (error.isEmpty()) {
+  return DEFAULT_ERROR.exceptionConstructor.apply(message);
 }
 
 Optional<W3CError<? extends WebDriverException>> w3CError =
     ERRORS.stream().filter(err -> error.equals(err.w3cErrorString)).findFirst();
 if (w3CError.isPresent()) {
-  return w3CError.get().exceptionConstructor.apply((String) message);
+  return w3CError.get().exceptionConstructor.apply(message);
 }
 String extendedMessage = String.format("%s (error code: \"%s\")", message, error);
 return DEFAULT_ERROR.exceptionConstructor.apply(extendedMessage);

• Apply / Chat