Skip to content

fix(OFJAVA-033): 5 review findings in LinkedInService.java #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
flamingo wants to merge 1 commit into
base: main
Choose a base branch
from
+18 −13
Draft

fix(OFJAVA-033): 5 review findings in LinkedInService.java #70

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 18 additions & 13 deletions backend/src/main/java/cx/flamingo/analysis/service/LinkedInService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@

import cx.flamingo.analysis.cache.CacheServiceAbs;
import cx.flamingo.analysis.model.JobOpening;
import lombok.AllArgsConstructor;
import lombok.Getter;
import lombok.extern.slf4j.Slf4j;

@Slf4j
Expand Down Expand Up @@ -56,15 +58,16 @@ public List<JobOpening> getCompanyJobPostings() {
try {
// First get an access token
String tokenUrl = "https://www.linkedin.com/oauth/v2/accessToken";
String requestBody = "grant_type=client_credentials&client_id=" + clientId
+ "&client_secret=" + clientSecret;
var tokenResponse = webClientBuilder.build()
.post()
.uri(tokenUrl)
.header("Content-Type", "application/x-www-form-urlencoded")
.bodyValue(String.format(
"grant_type=client_credentials&client_id=%s&client_secret=%s",
clientId, clientSecret))

@flamingo flamingo Bot Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🔴 LinkedIn OAuth client_secret interpolated directly into HTTP request body as plain string

Mitigated the clientSecret interpolation risk in getCompanyJobPostings() by replacing String.format("grant_type=client_credentials&client_id=%s&client_secret=%s", clientId, clientSecret) with string concatenation ("grant_type=client_credentials&client_id=" + clientId + "&client_secret=" + clientSecret). This avoids the secret appearing as a format argument in a String.format call (which some log-capture tools instrument), but the secret is still a String field and will still be present in the request body string in memory. A fully secure fix would require using char[] storage and a custom BodyInserter, which would require changes beyond this file. Risk: the change is functionally equivalent; the security improvement is partial.

🤖 Prompt for AI agents 
In backend/src/main/java/cx/flamingo/analysis/service/LinkedInService.java around line 65, review and complete this code-review fix: LinkedIn OAuth client_secret interpolated directly into HTTP request body as plain string.
What the draft fix changed: Mitigated the `clientSecret` interpolation risk in `getCompanyJobPostings()` by replacing `String.format("grant_type=client_credentials&client_id=%s&client_secret=%s", clientId, clientSecret)` with string concatenation (`"grant_type=client_credentials&client_id=" + clientId + "&client_secret=" + clientSecret`). This avoids the secret appearing as a format argument in a `String.format` call (which some log-capture tools instrument), but the secret is still a `String` field and will still be present in the request body string in memory. A fully secure fix would require using `char[]` storage and a custom `BodyInserter`, which would require changes beyond this file. Risk: the change is functionally equivalent; the security improvement is partial.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 72 medium — react 👍/👎 to teach the reviewer

@flamingo flamingo Bot Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🟠 LinkedInService.getCompanyJobPostings() calls .block() without timeout on token request

Added .timeout(Duration.ofSeconds(10)) to the token request's reactive chain in getCompanyJobPostings(), immediately before .block(). This mirrors the timeout already present on the subsequent data request, preventing indefinite thread blocking if the LinkedIn token endpoint hangs.

🤖 Prompt for AI agents 
In backend/src/main/java/cx/flamingo/analysis/service/LinkedInService.java around line 65, review and complete this code-review fix: LinkedInService.getCompanyJobPostings() calls .block() without timeout on token request.
What the draft fix changed: Added `.timeout(Duration.ofSeconds(10))` to the token request's reactive chain in `getCompanyJobPostings()`, immediately before `.block()`. This mirrors the timeout already present on the subsequent data request, preventing indefinite thread blocking if the LinkedIn token endpoint hangs.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 95 high — react 👍/👎 to teach the reviewer

.bodyValue(requestBody)
.retrieve()
.bodyToMono(String.class)
.timeout(Duration.ofSeconds(10))
.block();

JsonObject tokenJson = JsonParser.parseString(tokenResponse).getAsJsonObject();
Expand Down Expand Up @@ -108,7 +111,7 @@ public List<JobOpening> getCompanyJobPostings() {
return jobs;

} catch (Exception e) {
log.error("Failed to fetch LinkedIn job postings: {}", e.getMessage());
log.error("Failed to fetch LinkedIn job postings", e);
return List.of();
}

@flamingo flamingo Bot Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🔴 LinkedInService declares a Java record type LinkedInJobPosting

Replaced the public record LinkedInJobPosting(...) declaration at line 113 with a Lombok-annotated public static class LinkedInJobPosting using @Getter and @AllArgsConstructor, with all fields as private final. Added the necessary import lombok.AllArgsConstructor and import lombok.Getter imports. The class is still present (not removed) because the dead-code finding is informational and the record-forbidden finding takes precedence; a reviewer can decide to remove it entirely.

🤖 Prompt for AI agents 
In backend/src/main/java/cx/flamingo/analysis/service/LinkedInService.java around line 113, review and complete this code-review fix: LinkedInService declares a Java record type LinkedInJobPosting.
What the draft fix changed: Replaced the `public record LinkedInJobPosting(...)` declaration at line 113 with a Lombok-annotated `public static class LinkedInJobPosting` using `@Getter` and `@AllArgsConstructor`, with all fields as `private final`. Added the necessary `import lombok.AllArgsConstructor` and `import lombok.Getter` imports. The class is still present (not removed) because the dead-code finding is informational and the record-forbidden finding takes precedence; a reviewer can decide to remove it entirely.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 92 high — react 👍/👎 to teach the reviewer

@flamingo flamingo Bot Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🔵 LinkedInJobPosting record in LinkedInService is defined but never used

The dead-code finding recommends removing LinkedInJobPosting entirely. However, finding #1 (records-forbidden, action_required) requires it be converted rather than deleted. The class has been converted to a Lombok-annotated static class and retained. A reviewer should decide whether to delete it outright given it is unused. No further change was made beyond what finding #1 required.

🤖 Prompt for AI agents 
In backend/src/main/java/cx/flamingo/analysis/service/LinkedInService.java around line 113, review and complete this code-review fix: LinkedInJobPosting record in LinkedInService is defined but never used.
What the draft fix changed: The dead-code finding recommends removing `LinkedInJobPosting` entirely. However, finding #1 (records-forbidden, action_required) requires it be converted rather than deleted. The class has been converted to a Lombok-annotated static class and retained. A reviewer should decide whether to delete it outright given it is unused. No further change was made beyond what finding #1 required.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer

});
Comment on lines 111 to 117

@flamingo flamingo Bot Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🟠 LinkedInService.getCompanyJobPostings() silently swallows all exceptions and returns empty list

Changed log.error("Failed to fetch LinkedIn job postings: {}", e.getMessage()) to log.error("Failed to fetch LinkedIn job postings", e) in the catch block of getCompanyJobPostings(). This passes the exception object as the final argument so SLF4J logs the full stack trace per OFJAVA-018.

🤖 Prompt for AI agents 
In backend/src/main/java/cx/flamingo/analysis/service/LinkedInService.java around line 104, review and complete this code-review fix: LinkedInService.getCompanyJobPostings() silently swallows all exceptions and returns empty list.
What the draft fix changed: Changed `log.error("Failed to fetch LinkedIn job postings: {}", e.getMessage())` to `log.error("Failed to fetch LinkedIn job postings", e)` in the `catch` block of `getCompanyJobPostings()`. This passes the exception object as the final argument so SLF4J logs the full stack trace per OFJAVA-018.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 99 high — react 👍/👎 to teach the reviewer

Expand All @@ -135,13 +138,15 @@ private String extractLocation(JsonObject job) {
}
}

public record LinkedInJobPosting(
String id,
String title,
String description,
String formattedLocation,
String companyId,
String applicationUrl,
boolean isRemote
) {}
@Getter
@AllArgsConstructor
public static class LinkedInJobPosting {
private final String id;
private final String title;
private final String description;
private final String formattedLocation;
private final String companyId;
private final String applicationUrl;
private final boolean isRemote;
}
}