...
The problem is alleviated by creating a copy of the mutable input and using it to perform operations so that the original object is left unscathed. This can be realized by implementing the java.lang.Cloneable interface and declaring a public clone method when the class is final or by using a copy constructor. Performing a manual copy of object state within the caller becomes necessary if the mutable class is declared final (that is, it cannot provide an accessible copy method). See the guideline OBJ36OBJ10-J. Provide mutable classes with a clone method to allow passing instances to untrusted code safely for more information. Note that any input validation must be performed on the copy and not the original object.
...