Propagating the contents of exceptions without explicitly filtering sensitive information often results in information leaks and lets an attacker build the attack surface. An attacker may craft input parameters such that underlying structures and mechanisms of the application are inadvertently exposed. Information leaks can result from both - the exception message text and the type of exception. For example, with FileNotFoundException, the message reveals the file system layout while the type conveys the absence of the file.
...