Immutability helps to support security reasoning. It is safe to share immutable objects without risk that the recipient can modify them [Mettler 2010b2010].
Programmers often incorrectly assume that declaring a field or variable final makes the referenced object immutable. Declaring variables that have a primitive type to be final does prevent changes to their values after initialization (by normal Java processing). However, when the variable has a reference type, the presence of a final clause in the declaration only makes the reference itself immutable. The final clause has no effect on the referenced object. Consequently, the fields of the referenced object may be mutable. For example, according to the Java Language Specification, §4.12.4, "final Variables" [JLS 2011],
...
Item 13, "Minimize the Accessibility of Classes and Members" | |
Chapter 6, "Interfaces and Inner Classes" | |
[JLS 2011] | |
Class Properties for Security Review in an Object-Capability Subset of Java |
...