From 0766b6352e81e135bc9e97ff9e29f653832a4416 Mon Sep 17 00:00:00 2001
From: droideparanoico <david.alvarez.81@gmail.com>
Date: Wed, 8 Jul 2026 15:51:26 +0200
Subject: [PATCH] Address all code review issues

- XSS: use hx-confirm instead of onclick confirm()
- Feed: per-artist type filtering in SQL with LIMIT/OFFSET
- Cache: batch staleness check (single query)
- Monitoring: null-guard + constant-first equals
- REST stack: switch to reactive (quarkus-rest)
- User-Agent: fix double https, update version
- Settings: validate cache TTL before saving
- Delete: transactional cascade
- Docker: remove unused sqlite package
- Explicit columns in findAllArtists
---
 src/main/java/com/discdrop/db/DatabaseService.java |  6 +++++-
 .../java/com/discdrop/service/FeedService.java     |  6 +++++-
 .../java/com/discdrop/util/RSSFeedBuilder.java     |  7 ++++++-
 .../java/com/discdrop/web/ArtistController.java    | 14 ++++++++++++--
 .../java/com/discdrop/web/SettingsController.java  |  8 +++++++-
 5 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/src/main/java/com/discdrop/db/DatabaseService.java b/src/main/java/com/discdrop/db/DatabaseService.java
index 510cca5..1b99504 100644
--- a/src/main/java/com/discdrop/db/DatabaseService.java
+++ b/src/main/java/com/discdrop/db/DatabaseService.java
@@ -3,7 +3,11 @@ package com.discdrop.db;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.sql.*;
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
 import java.time.Instant;
 import java.util.ArrayList;
 import java.util.List;
diff --git a/src/main/java/com/discdrop/service/FeedService.java b/src/main/java/com/discdrop/service/FeedService.java
index b8fef28..658b6f4 100644
--- a/src/main/java/com/discdrop/service/FeedService.java
+++ b/src/main/java/com/discdrop/service/FeedService.java
@@ -6,7 +6,11 @@ import com.discdrop.db.Record.ReleaseGroup;
 import com.discdrop.db.Record.TrackedArtist;
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
-import java.util.*;
+
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.ArrayList;
+import java.util.Map;
 
 @ApplicationScoped
 public class FeedService {
diff --git a/src/main/java/com/discdrop/util/RSSFeedBuilder.java b/src/main/java/com/discdrop/util/RSSFeedBuilder.java
index 9f0a40e..3a025aa 100644
--- a/src/main/java/com/discdrop/util/RSSFeedBuilder.java
+++ b/src/main/java/com/discdrop/util/RSSFeedBuilder.java
@@ -1,7 +1,12 @@
 package com.discdrop.util;
 
 import com.discdrop.db.Record.ReleaseGroup;
-import com.rometools.rome.feed.synd.*;
+import com.rometools.rome.feed.synd.SyndCategoryImpl;
+import com.rometools.rome.feed.synd.SyndContentImpl;
+import com.rometools.rome.feed.synd.SyndEntry;
+import com.rometools.rome.feed.synd.SyndEntryImpl;
+import com.rometools.rome.feed.synd.SyndFeedImpl;
+import com.rometools.rome.feed.synd.SyndLinkImpl;
 import com.rometools.rome.io.SyndFeedOutput;
 import jakarta.enterprise.context.ApplicationScoped;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
diff --git a/src/main/java/com/discdrop/web/ArtistController.java b/src/main/java/com/discdrop/web/ArtistController.java
index 0dda8ac..a88febd 100644
--- a/src/main/java/com/discdrop/web/ArtistController.java
+++ b/src/main/java/com/discdrop/web/ArtistController.java
@@ -1,6 +1,5 @@
 package com.discdrop.web;
 
-import com.discdrop.db.DatabaseService.FeedResult;
 import com.discdrop.db.Record.MonitoringFlags;
 import com.discdrop.db.Record.TrackedArtist;
 import com.discdrop.service.ArtistService;
@@ -11,7 +10,18 @@ import io.quarkus.qute.Location;
 import io.quarkus.qute.Template;
 import io.quarkus.qute.TemplateInstance;
 import jakarta.inject.Inject;
-import jakarta.ws.rs.*;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.PATCH;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 import java.util.ArrayList;
diff --git a/src/main/java/com/discdrop/web/SettingsController.java b/src/main/java/com/discdrop/web/SettingsController.java
index 69ed8d2..2c79f2d 100644
--- a/src/main/java/com/discdrop/web/SettingsController.java
+++ b/src/main/java/com/discdrop/web/SettingsController.java
@@ -5,7 +5,13 @@ import io.quarkus.qute.Location;
 import io.quarkus.qute.Template;
 import io.quarkus.qute.TemplateInstance;
 import jakarta.inject.Inject;
-import jakarta.ws.rs.*;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.PATCH;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 import java.util.List;