[grid] use only the origin of se:remoteUrl for proxied URLs and guard returned-caps stripping

Author: titusfortner

java/src/org/openqa/selenium/grid/node/local/LocalNode.java

@@ -1331,7 +1331,12 @@ private URI resolvePublicGridUri(Capabilities caps) {
         String scheme = uri.getScheme();
         if (uri.getHost() != null
             && ("http".equalsIgnoreCase(scheme) || "https".equalsIgnoreCase(scheme))) {
-          return uri;
+          // Use only the reachable origin (scheme/userinfo/host/port). se:remoteUrl advertises
+          // where the client reached the Grid so proxied URLs get a reachable host/port; the URL's
+          // path is the client's HTTP endpoint (e.g. "/wd/hub"), not a Grid sub-path. Folding it in
+          // would produce websocket URLs the Node's routes (keyed off the configured grid-url
+          // sub-path) do not match. A real reverse-proxy path prefix is configured via grid-url.
+          return new URI(scheme, uri.getUserInfo(), uri.getHost(), uri.getPort(), null, null, null);
         }
       } catch (URISyntaxException e) {
         // Fall through to the warning below.

java/test/org/openqa/selenium/grid/node/NodeTest.java

@@ -229,6 +229,45 @@ void usesClientReachableAddressForProxiedUrlsWhenRemoteUrlProvided() {
         .isEqualTo("ws://localhost:9999/session/" + session.getId() + "/se/vnc");
   }
 
+  @Test
+  void ignoresRemoteUrlPathWhenBuildingProxiedUrls() {
+    // The client's URL path (e.g. "/wd/hub") is its HTTP endpoint, not a Grid sub-path; folding it
+    // into the proxied websocket URLs would produce routes the Node does not serve. Only the
+    // origin (host/port) of se:remoteUrl is used.
+    Capabilities request =
+        new ImmutableCapabilities(
+            "browserName",
+            "cheese",
+            "se:vncLocalAddress",
+            "localhost:5900",
+            "se:remoteUrl",
+            "http://localhost:9999/wd/hub");
+
+    Either<WebDriverException, CreateSessionResponse> response =
+        local.newSession(createSessionRequest(request));
+    assertThatEither(response).isRight();
+
+    Session session = response.right().getSession();
+    assertThat(String.valueOf(session.getCapabilities().getCapability("se:vnc")))
+        .isEqualTo("ws://localhost:9999/session/" + session.getId() + "/se/vnc");
+  }
+
+  @Test
+  void doesNotReturnRemoteUrlInSessionCapabilities() {
+    Capabilities request =
+        new ImmutableCapabilities(
+            "browserName", "cheese", "se:remoteUrl", "http://user:secret@localhost:9999");
+
+    Either<WebDriverException, CreateSessionResponse> response =
+        local.newSession(createSessionRequest(request));
+    assertThatEither(response).isRight();
+
+    // se:remoteUrl is transport-only: it is consumed to build the proxied URLs and must not be
+    // echoed back in the session capabilities, where its embedded credentials could leak.
+    Session session = response.right().getSession();
+    assertThat(session.getCapabilities().getCapability("se:remoteUrl")).isNull();
+  }
+
   @Test
   void preservesCredentialsFromClientAdvertisedRemoteUrl() {
     Capabilities request =