Page History

...

... if a final variable holds a reference to an array, then the components of the array may be changed by operations on the array, but the variable will always refer to the same array.

Noncompliant Code Example

In this noncompliant code example, the values of instance fields a and b can be changed even after their initialization. When an object reference is declared final, it only signifies that the reference cannot be changed, whereas the referenced contents can still be altered.

class FinalClass{
  private int a;
  private int b;

  FinalClass(int a, int b){
    this.a = a;
    this.b = b;
  }
  void set_ab(int a, int b){
    this.a = a;
    this.b = b;
  }
  void print_ab(){
    System.out.println("the value a is: " + this.a);
    System.out.println("the value b is: " + this.b);
  }
}

public class FinalCaller {
  public static void main(String[] args) {
    final FinalClass fc = new FinalClass(1, 2);
    fc.print_ab();
    // change the value of a,b.
    fc.set_ab(5, 6);
    fc.print_ab();
  }
}

Compliant Solution

If a and b have to be kept immutable after their initialization, the simplest approach is to declare them as final. However, this requires the elimination of the setter method set_ab().

private final int a;
private final int b;

Compliant Solution

This compliant solution provides a clone() method in the class and does not require the elimination of the setter method. The clone() method returns a copy of the original object. This new object can be freely used without affecting the original object. Using the clone() method allows the class to remain mutable. (OBJ36-J. Provide mutable classes with a clone method to allow passing instances to untrusted code safely)

...

The class is declared final to prevent subclasses from overriding the clone() method. This enables the class to be accessed and used, while preventing the fields from being modified, and complies with OBJ36-J. Provide mutable classes with a clone method to allow passing instances to untrusted code safely.

Noncompliant Code Example

Another common mistake is to use a {{public static final}} array. Clients can trivially modify the contents of the array (although they are unable to change the array itself, as it is {{final}}). In this noncompliant code example, the elements of the {{items\[\]}} array, are modifiable.

public static final String[] items = { ... };

Compliant Solution

This compliant solution defines a private array and a public method that returns a copy of the array.

...

As a result, the original array values cannot be modified by a client.

Compliant Solution

This compliant solution declares a private array from which a public immutable list is constructed.

...

Neither the original array values nor the public list can be modified by a client. For more details about unmodifiable wrappers, refer to SEC14-J. Provide sensitive mutable classes with unmodifiable wrappers.

Risk Assessment

Using final to declare the reference to a mutable object is potentially misleading because the contents of the object can still be changed.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[JLS 05|AA. Java References#JLS 05]\] Sections 4.12.4 "final Variables" and 6.6, "Access Control"
\[[Bloch 08|AA. Java References#Bloch 08]\] Item 13: Minimize the accessibility of classes and members
\[[Core Java 04|AA. Java References#Core Java 04]\] Chapter 6
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 607|http://cwe.mitre.org/data/definitions/607.html] "Public Static Final Field References Mutable Object"

...