Files: LocationController.java:200, ParametersController.java:124, SpecifiedLevelController.java:113, TimeZoneController.java:124, UnitsController.java:118, ConnectionPreparingDataSource.java:26,44
Multiple controllers are catching Exception broadly. This can mask unexpected errors and make debugging harder. It also risks swallowing security-relevant exceptions.
In all five cases I believe the catch blocks can be removed b/c ApiServlet is already handling the expected exceptions.
The controller-level catches are worse than ApiServlet handlers because:
1.
They returned generic 500 for all errors (even client errors like bad format)
2.
SpecifiedLevelController leaked ex.getLocalizedMessage() to the client
3.
TimeZoneController and UnitsController returned plain text instead of JSON
4.
They logged everything at SEVERE even for client errors
5.
They didn't include the incidentIdentifier that the ApiServlet DataAccessException handler provides for tracing
The request is to remove the broad "catch (Exception e)" blocks and verify that the tests pass and that there isn't any Controller-specific handling needed.