Course audit report

Object Oriented Programming 2

Done Role: Backend Engineer 8 Findings Object-Oriented Java Programming — Applied Apis And Gui
Auditor Done Market Fit Done Topics Done
Run another role
8 findings · 1 critical 2 high 4 medium 1 low
Security risk Week 9 - Accessing DB ( Part 3 ).pdf page 6, Week 9 - Accessing DB ( Part 3 ).pdf page 24

What the slide says

private static final String PASSWORD = "deitel";
Why this is flagged

The course teaches embedding database credentials directly in source as static final String constants — a textbook insecure pattern that ships authentication material with the binary and cannot be rotated without rebuilding. The username/password literal pair is repeated across three JDBC examples (mona/i243 in QueryVersion2, deitel/deitel in JdbcRowSetTest and PersonQueries) and is presented as the way to connect to a database, not as a counterexample.

Adjudicator's note: Three JDBC code examples in the curriculum literally hard-code the database username and password as `static final String` fields with no warning or contrast slide; no nearby slide marks the pattern as insecure or shows a corrected version, so the burden-of-proof default is FLAG.

Primary source ✓ Source checked

cwe.mitre.org

The product contains hard-coded credentials, such as a password or cryptographic key.

What to learn instead

Read credentials from environment variables, an external configuration file with restricted permissions, or a secrets manager (Vault, AWS Secrets Manager, etc.). Show students how to keep secrets out of source control from day one.

Misleading idea Week 8 - Accessing DB ( Part 2 ).pdf page 20

What the slide says

Any local variable that will be used in an anonymous inner class must be declared final; otherwise, a compilation error occurs.
Why this is flagged

Since Java 8 the rule is that captured local variables must be `final` *or effectively final* — an unmodified local that is never reassigned needs no `final` keyword. The slide's blanket "must be declared final" is the pre-Java-8 rule and will mislead students into adding redundant `final` modifiers (or worse, doubting working code).

Adjudicator's note: The Java Language Specification §8.1.3 (Java SE 8 onward) explicitly relaxed this rule. The slide is taught as a hard rule with no contrast or paired correction nearby — straightforward FLAG.

Primary source ✓ Source checked

docs.oracle.com

Any local variable, formal parameter, or exception parameter used but not declared in an inner class must either be declared final or be effectively final

What to learn instead

Update the wording to: "Any local variable used in an anonymous inner class must be either `final` or *effectively final* (Java 8+); attempting to reassign a captured local is a compile-time error."

Misleading idea Week 10 - Files Streams and Object Serialization ( Part 1 ).pdf page 5

What the slide says

sequence of characters in which every character is two
Why this is flagged

The slide claims "every character is two bytes," conflating the width of a Java `char` (a UTF-16 code unit) with a Unicode character. Supplementary code points (emoji, many CJK characters, historical scripts) require *two* `char` values — a surrogate pair — totalling four bytes, so the blanket "every character is two bytes" rule is wrong and gives students the same broken mental model that produces off-by-one bugs in `length()`/`charAt()` over emoji.

Adjudicator's note: Oracle's `java.lang.Character` documentation directly contradicts the slide's claim by spelling out the surrogate-pair representation of supplementary characters. The slide states the rule unconditionally — FLAG.

Primary source ✓ Source checked

docs.oracle.com

supplementary characters are represented as a pair of char values, the first from the high-surrogates range, (\uD800-\uDBFF), the second from the low-surrogates range (\uDC00-\uDFFF)

What to learn instead

Rewrite the bullet as: "Java's `char` is a 16-bit UTF-16 *code unit*. BMP characters (U+0000 to U+FFFF) fit in one `char`; supplementary characters (emoji and many CJK glyphs) are encoded as a surrogate pair — two `char`s, four bytes — so `String.length()` counts code units, not characters. Use `codePointAt`/`codePointCount` when you need the actual character count."

No longer works Week 2+3 - Exception Handling.pdf page 91

What the slide says

Run with Java Web Start
Why this is flagged

The slide is a NetBeans Project Properties screenshot showing the "Run with Java Web Start" option as a current way to run/debug the application. Java Web Start was removed from Oracle JDK distributions in JDK 11; on a current toolchain this checkbox does nothing and the deployment mechanism it enables no longer exists in the JDK.

Adjudicator's note: The Oracle JDK 17 migration guide explicitly lists Web Start among components removed in JDK 11. The slide presents the option without any "this is legacy" caveat. FLAG.

Primary source ✓ Source checked

docs.oracle.com

Java applet and Web Start functionality, including the Java plug-in, the Java Applet Viewer, Java Control Panel, and Java Web Start, along with javaws tool, have been removed in JDK 11.

What to learn instead

Drop the screenshot and the assertion-debugging instructions that depend on Web Start. For local debugging, point students at the IDE's standard Run/Debug configuration; for deployment, mention `jlink`/`jpackage` or third-party reimplementations such as OpenWebStart if Web Start compatibility is genuinely needed.

Deprecated Week 2+3 - Exception Handling.pdf page 57

What the slide says

Finalize is used to perform clean up processing just before object is garbage collected.
Why this is flagged

The slide compares `final`, `finally`, and `finalize` as three current language features and instructs students to remember `finalize` as "a method ... used to perform clean up processing just before object is garbage collected." `Object.finalize()` is `@Deprecated(since="9")` and Oracle's own docs label finalization "inherently problematic" — teaching it as a current cleanup tool builds the wrong mental model.

Adjudicator's note: Oracle's `Object.finalize` Javadoc carries `@Deprecated(since="9")` and the rationale text "The finalization mechanism is inherently problematic." The slide presents finalize as a normal language feature — FLAG.

Primary source ✓ Source checked

docs.oracle.com

Deprecated. The finalization mechanism is inherently problematic.

What to learn instead

Keep the `final`/`finally` half of the comparison, and replace the `finalize` row with `try-with-resources` + `AutoCloseable`/`Cleaner` as the modern way to release resources. Mention `Object.finalize()` only as a historical/deprecated artifact.

Deprecated Week 6 - GUI Components ( Part 3 ).pdf page 11

What the slide says

Method getModifiers determines whether any modifier keys (such as Shift, Alt and Ctrl) were pressed when the key event occurred.
Why this is flagged

The slide instructs students to use `InputEvent.getModifiers()` and the static `KeyEvent.getKeyModifiersText()` to handle modifier keys. Both have been `@Deprecated(since="9")` in Oracle's API docs in favor of `getModifiersEx()` / `getModifiersExText()`; using the legacy methods produces deprecation warnings on a modern JDK and silently ignores extended modifiers.

Adjudicator's note: The Oracle Java SE 17 InputEvent API page documents `getModifiers()` and the legacy `*_MASK` constants as `@Deprecated(since="9")` with the recommendation to use `getModifiersEx()` instead. The slide teaches the deprecated form as the way to do modifier-key handling — FLAG.

Primary source ✓ Source checked

docs.oracle.com

It is recommended that extended modifier keys and getModifiersEx() be used instead

What to learn instead

Teach `getModifiersEx()` with the `*_DOWN_MASK` constants (`SHIFT_DOWN_MASK`, `CTRL_DOWN_MASK`, etc.) and `KeyEvent.getModifiersExText(int)` for the human-readable string. Show the `(event.getModifiersEx() & (onmask | offmask)) == onmask` idiom from the Oracle docs.

No longer works Week 7 - Accessing DB ( Part 1 ).pdf page 11

What the slide says

see the Java DB Developer's Guide at
Why this is flagged

The course leans on "Java DB" — Oracle's distribution of Apache Derby that used to ship inside the JDK — and points students at `docs.oracle.com/javadb/10.10.1.1/devguide/derbydev.pdf` plus a `jdbc:derby:` URL described as Java DB-specific. JavaDB has not been in the JDK since JDK 9; lab setups that assume the JDK ships the database will silently break on any current toolchain.

Adjudicator's note: Oracle's JDK 17 migration guide states JavaDB is no longer included in the JDK. The slides treat Java DB as a current bundled component and link to its documentation as if it were live — FLAG.

Primary source ✓ Source checked

docs.oracle.com

JavaDB, which was a rebranding of Apache Derby, is no longer included in the JDK.

What to learn instead

Drop the "Java DB" branding and the Oracle javadb URL. If Derby is still desired, install Apache Derby externally (https://db.apache.org/derby/derby_downloads.html); otherwise switch the lab to a more current teaching DB (H2, SQLite, or PostgreSQL).

Deprecated Week 2+3 - Exception Handling.pdf page 79

What the slide says

public Image getImage(URL url, String name) {
Why this is flagged

The Javadoc-tutorial worked example documents a method from the Java Applet API (`Applet.getImage`). The Applet API and `appletviewer` tool were deprecated in JDK 9 (JEP 289) and the entire API has since been deprecated for removal (JEP 398), so building a Javadoc lesson around the Applet class teaches students to read documentation for an effectively dead API.

Adjudicator's note: JEP 289 (Deprecate the Applet API) marks `java.applet.Applet` and related classes `@Deprecated(since="9")`. The slide presents the applet-based getImage docstring as a current Javadoc example without any deprecation caveat — FLAG, low severity since the lesson is about Javadoc syntax, not applets.

Primary source ✓ Source checked

openjdk.org

Add the @Deprecated(since="9") annotation to the following classes:

What to learn instead

Replace the Javadoc example with code from a non-deprecated API (e.g. a `java.util.List` method, an `HttpClient` example, or a custom domain class). The Javadoc tags being demonstrated (@param, @return, @link, @see) are independent of the Applet API.

This is a Java desktop-applications course (Swing GUI + Apache Derby JDBC + object serialization) whose domain barely overlaps backend hiring — within its own depth bound the only defensible extensions are swapping the JDBC labs from Derby to PostgreSQL and lifting the existing assert-statement section into a JUnit @Test introduction; the rest of the modern backend stack (Docker, AWS, REST/HTTP, microservices, Kubernetes, Redis, Kafka, OAuth/JWT) has zero partial coverage to extend and is therefore out of scope for this course.

Gaps

PostgreSQL as the JDBC target database (vs. Apache Derby / Java DB)

The JDBC unit teaches database connectivity but pins every concrete example to Apache Derby. PostgreSQL is named only twice — once in the RDBMS list ('PostgreSQL' alongside Oracle/MySQL/DB2 on Week 7 Page 4) and once as a URL-format row ('PostgreSQL jdbc:postgresql://hostname:portNumber/databaseName' in Fig. 24.24, Week 8 Page 34). Every code sample uses 'jdbc:derby://localhost:1527/books' (Week 8 Page 5) and 'jdbc:derby:books' (Week 9 Page 6). Extending the existing JDBC labs to point at a Postgres instance — same Connection/Statement/PreparedStatement API the course already teaches, just a different driver/URL — would close the gap while staying inside the standard-library JDBC depth bound. The course already lists Postgres in the URL table, so the partial-coverage anchor is explicit.

Unit testing with JUnit (@Test, assertEquals)

Section 11.11 of Week 2+3 already teaches Java's built-in 'assert' statement: 'Assertions help ensure a program's validity by catching potential bugs and identifying possible logic errors during development' and shows AssertTest.java with 'assert (number >= 0 && number <= 10) : "bad number: " + number;' (Week 2+3 Pages 86-90). The intent — programmatically validating expected behaviour during development — is the same intent as a unit test. The course presently stops at the language-level assert keyword run via 'java -ea'. Extending this section to introduce a JUnit @Test method with assertEquals/assertThrows applied to the existing Employee/Account classes the course already builds would lift the existing assertions material to the standard form the market expects, without crossing into build/deployment tooling. Anchor slide for partial coverage: 'I 1.11 Assertions' (Week 2+3 Page 3) and 'Assertions help ensure a program's validity by catching potential bugs and identifying possible logic errors during development' (Week 2+3 Page 86).

What the curriculum actually teaches (15 skills)
  • Java OOP fundamentals (classes, inheritance, polymorphism, encapsulation) · Week 1 - Revision
    LECTURE OUTLINE: Classes, methods; Inheritance; Polymorphism; Overloading methods; Overriding methods (Week 1, Page 1)
  • Java exception handling (try/catch/finally, multi-catch, throw, custom exceptions, Throwable hierarchy) · Week 2+3 - Exception Handling
    'Use try blocks to delimit code in which exceptions might occur. Use throw to indicate a problem. Use catch blocks to specify exception handlers. Use the finally block to release resources. Understand the exception class hierarchy. Create user-defined exceptions.' (Week 2+3, Page 2)
  • Java built-in assert statement for runtime validation · Week 2+3 - Exception Handling
    'Java includes two versions of the assert statement for validating assertions programatically... Assertions help ensure a program's validity by catching potential bugs and identifying possible logic errors during development.' (Week 2+3, Section 11.11 Assertions, Pages 86-90)
  • Java Swing GUI components (JFrame, JOptionPane, JLabel, JButton, JTextField, JComboBox, JList, JPanel) · Week 4 - GUI Components Part 1, Week 5 - GUI Components Part 2, Week 6 - GUI Components Part 3
    'Swing GUI components located in package javax.swing... Fig. 12.4 | Some basic Swing GUI components: JLabel, JTextField, JButton, JCheckBox, JComboBox, JList, JPanel.' (Week 4, Pages 17-18)
  • Swing event handling (ActionListener, ActionEvent, WindowAdapter) · Week 4 - GUI Components Part 1, Week 8 - Accessing DB Part 2
    'submitButton.addActionListener( new ActionListener() { public void actionPerformed(ActionEvent event) { ... } });' (Week 8, Page 7)
  • Java NIO file/directory API (Path, Paths, Files, DirectoryStream) · Week 10 - Files Streams and Object Serialization Part 1
    'Interfaces Path and DirectoryStream and classes Paths and Files (all from package java.nio.file) are useful for retrieving information about files and directories on disk.' (Week 10, Page 9)
  • Sequential text-file I/O via Formatter and Scanner · Week 10 - Files Streams and Object Serialization Part 1
    'Character-based input and output can be performed with classes Scanner and Formatter.' (Week 10, Page 8)
  • Java object serialization (Serializable, ObjectOutputStream, ObjectInputStream, transient) · Week 11 - Files Streams and Object Serialization Part 2
    'Classes ObjectInputStream and ObjectOutputStream (package java.io)... enable entire objects to be read from or written to a stream... A class that implements Serializable is tagged as being a Serializable object.' (Week 11, Pages 4-6)
  • Java multithreading (Thread class, Runnable interface, thread life cycle, synchronized keyword, wait/notify) · Week 12 - Concurrency
    'Understand concurrency, parallelism and multithreading. Learn the thread life cycle. Use ExecutorService to launch concurrent threads that execute Runnables.' (Week 12, Page 2)
  • java.util.concurrent ExecutorService / Executors framework · Week 12 - Concurrency
    '// Fig. 23.4: TaskExecutor.java // Using an ExecutorService to execute Runnables. import java.util.concurrent.Executors; import java.util.concurrent.ExecutorService;' (Week 12, Pages 38-40)
  • JDBC API (DriverManager, Connection, Statement, ResultSet, PreparedStatement, RowSet) · Week 7 - Accessing DB Part 1, Week 8 - Accessing DB Part 2, Week 9 - Accessing DB Part 3
    'Java programs interact with databases using the Java Database Connectivity (JDBC™) API.' (Week 7, Page 5)
  • SQL (SELECT, WHERE, ORDER BY, INNER JOIN, INSERT, UPDATE, DELETE) · Week 7 - Accessing DB Part 1
    'Fig. 24.10 | SQL query keywords. SELECT / FROM / WHERE / GROUP BY / ORDER BY / INNER JOIN / INSERT / UPDATE / DELETE.' (Week 7, Page 13)
  • Apache Derby / Java DB as the JDBC target database · Week 7 - Accessing DB Part 1, Week 8 - Accessing DB Part 2, Week 9 - Accessing DB Part 3
    'private static final String DATABASE_URL = "jdbc:derby://localhost:1527/books";' (Week 8, Page 5) and 'The subprotocol derby indicates that the program uses a Java DB/Apache Derby-specific subprotocol' (Week 8, Pages 33-34)
  • PreparedStatement parameter binding for SQL injection prevention · Week 9 - Accessing DB Part 3
    'Error-Prevention Tip 24.3 PreparedStatements help prevent SQL injection attacks, which typically occur in SQL statements that include user input improperly.' (Week 9, Page 16)
  • JDBC transaction processing (setAutoCommit, commit, rollback) · Week 9 - Accessing DB Part 3
    'Connection method setAutoCommit specifies whether each SQL statement commits after it completes... If the argument to setAutoCommit is false, the program must end the transaction with a call to Connection method commit or Connection method rollback.' (Week 9, Section 24.10 Transaction Processing)

Only two prescriptions survive the depth bound and the partial-coverage rule: (1) re-pointing the JDBC labs from Apache Derby to PostgreSQL with env-var credentials and PreparedStatement-from-day-one (0.917 of postings), and (2) lifting the existing Java 'assert' section into a JUnit @Test introduction (0.833 of postings). Together they touch the two highest-frequency demands the course has any partial-coverage anchor for.

Honestly: these two prescriptions close roughly two of the top backend demands and bring the course's existing JDBC and assertion material in line with the form the market actually uses, but they do not close the bulk of the backend hiring gap. The other high-frequency demands surfaced by Market-fit (Docker 0.917, REST API 0.917, AWS 0.833, Linux 0.75, Git 0.75, CI/CD 0.667, microservices 0.667, OAuth 0.583, Redis 0.583, Kubernetes 0.583, Kafka 0.5, GraphQL 0.5, JWT 0.5) have no partial-coverage anchor in this Java desktop-applications course and are therefore out of scope for it — they belong in a different course, not as prescriptions here.

#1 ~6h to learn

Re-point the JDBC labs from Apache Derby to PostgreSQL, with credentials read from environment variables and PreparedStatement used from the first user-input query

Swap the Derby labs for PostgreSQL using the same JDBC API the course already teaches — and bake in env-var credentials and PreparedStatement from the first query, not bolted on later.

postgresqljdbcpostgresql jdbc driverpreparedstatementenvironment-variable credentials

Where it fits

Week 8 - Accessing DB Part 2 · Week 8 is where the course first turns the JDBC API into a runnable lab (DATABASE_URL, Connection, Statement, ResultSet). Fig. 24.24 on Week 8 Page 34 already lists 'PostgreSQL jdbc:postgresql://hostname:portNumber/databaseName' alongside the Derby URL — the partial-coverage anchor is explicit. The extension is to pivot every concrete code sample from 'jdbc:derby://localhost:1527/books' to a PostgreSQL URL using the same Connection/Statement/PreparedStatement surface. Two Auditor-flagged patterns sit in this same unit and must be replaced, not extended: (a) the hardcoded 'private static final String PASSWORD = "deitel";' on Week 9 pages 6 and 24 must be replaced with credentials read from environment variables (or a properties file outside source control) on the very first PostgreSQL example, per the Auditor's suggested_replacement; (b) the string-concatenated 'SELECT * FROM AUTHORS WHERE FIRSTNAME LIKE ...' on Week 8 page 9 must be replaced with a PreparedStatement using '?' placeholders and setString — not deferred to Week 9. Week 7 Page 11's dead 'Java DB Developer's Guide' link should also be dropped in favor of the PostgreSQL JDBC driver docs.

Prerequisites

  • JDBC API surface (DriverManager, Connection, Statement, ResultSet) · already covered in Week 7 - Accessing DB Part 1
  • SQL SELECT/WHERE/ORDER BY/INNER JOIN/INSERT/UPDATE/DELETE · already covered in Week 7 - Accessing DB Part 1
  • PreparedStatement parameter binding (used here from day one, not deferred) · already covered in Week 9 - Accessing DB Part 3
  • JDBC transaction processing (setAutoCommit/commit/rollback) · already covered in Week 9 - Accessing DB Part 3
  • Reading credentials from environment variables / external config not yet covered
#2 ~6h to learn

Lift the existing Java 'assert' / Section 11.11 Assertions material into a JUnit 5 @Test introduction (assertEquals, assertThrows) applied to the course's existing Account/Employee classes

Promote the existing 'assert' lecture into a one-class JUnit @Test walkthrough on the Account/Employee classes the course already builds — same intent, the form the market actually writes.

junitjunit 5@testassertequalsassertthrowsunit testing

Where it fits

Week 2+3 - Exception Handling · Section 11.11 of Week 2+3 (Pages 86–90) already teaches the language-level 'assert' statement with the explicit pedagogical framing that 'Assertions help ensure a program's validity by catching potential bugs and identifying possible logic errors during development' and shows AssertTest.java run via 'java -ea'. That is the same intent as a unit test, just stuck at the keyword-and-VM-flag level. The natural extension — well within standard-library/applied-API depth — is to introduce a single JUnit 5 test class with @Test methods that call assertEquals on, e.g., the deposit/withdraw behaviour of the Account class and assertThrows on the user-defined exceptions the course already builds. This stays inside the course's hands-on standard-library scope (JUnit ships as a single jar on the classpath) and does not push into Maven/Gradle/CI build tooling, which the depth bound excludes. The Auditor-flagged items in this unit (Web Start screenshot on page 91, the Applet getImage Javadoc example on page 79, the finalize() row on page 57) are not used as prerequisites here and are not extended by this prescription.

Prerequisites

  • Java OOP (classes, methods, constructors) · already covered in Week 1 - Revision
  • Exception handling and user-defined exceptions (for assertThrows examples) · already covered in Week 2+3 - Exception Handling
  • Java built-in 'assert' statement (the partial-coverage anchor being lifted) · already covered in Week 2+3 - Exception Handling