Review a Spring REST Controller for Correctness and Per-Request Waste

Scenario

You are performing a code review for an internal portfolio management service at a financial brokerage. A junior engineer has submitted the following Spring Boot REST controller responsible for executing stock order placements and fetching order histories.

@RestController
@RequestMapping("/api/orders")
public class OrderController {

    @Autowired
    private OrderRepository orderRepository;

    private SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");

    @PostMapping("/create")
    public ResponseEntity placeOrder(@RequestBody OrderRequest request) {
        // Heavy client created on every incoming request
        PricingClient pricingClient = new PricingClient();
        
        if (request.getQuantity() <= 0) {
            return ResponseEntity.status(500).body("Quantity must be positive");
        }

        double currentPrice = pricingClient.getQuote(request.getTicker());
        Order order = new Order();
        order.setTicker(request.getTicker());
        order.setQuantity(request.getQuantity());
        order.setExecutedPrice(currentPrice);
        order.setTimestamp(dateFormat.format(new Date()));

        orderRepository.save(order);
        return ResponseEntity.status(200).body("Order placed successfully");
    }

    @GetMapping("/history/{accountId}")
    public List getHistory(@PathVariable String accountId) {
        try {
            return orderRepository.findAllByAccountId(accountId);
        } catch (Exception e) {
            return new ArrayList();
        }
    }
}

Task

1. Identify Bugs & Anti-Patterns: Identify at least 5 distinct issues across thread safety, HTTP semantics, layer abstraction, exception handling, resource allocation, and scalability.
2. Propose the Refactored Design: Describe how each issue should be resolved following modern Spring Boot best practices (e.g., dependency injection, @ControllerAdvice, input validation, and pagination).
3. Refactor the Code: Provide a clean, idiomatic version of the controller and any supporting error-handling advice.