...
Always provide mechanisms to create copies of the instances of a mutable class. This compliant solution implements the Cloneable interface and overrides the clone method to create a deep copy of the object. If it is possible that the accessor methods can be called from untrusted code, it is also advisable to copy all the mutable objects that are passed in before they are stored in the class (FIO31-J. Defensively copy mutable inputs and mutable internal components) or returned from any methods (OBJ37-J. Do not return references to private dataDefensively copy private mutable class members before returning their references). This is because untrusted code cannot be expected to call the object's clone() method to operate on the copy. This compliant solution not only provides a clone() method for trusted code but also guarantees that the state of the object cannot be compromised when the accessor method is called directly from untrusted code.
...
OBJ35-J. Use checked collections against external code 07. Object Orientation (OBJ) OBJ37-J. Do not return references to private dataDefensively copy private mutable class members before returning their references