Page History

Immutability helps to supporting security reasoning. It is safe to share immutable objects, without risk that the recipient can modify something that we are relying on them [Mettler 2010B].

Programmers could often incorrectly expect assume that declaring a field or variable final makes the referenced object immutable. Declaring variables that have a primitive type to be final does prevent changes to their values after initialization (unless the unsupported sun.misc.Unsafe class is used). However, when the variable has a reference type, the presence of a final clause in the declaration only makes the reference itself immutable. The final clause has no effect on the referenced object. Consequently, the fields of the referenced object can be mutable. For example, according to the Java Language Specification [JLS 2005], §4.12.4, "final Variables,"

...

Similarly, a final method parameter obtains an immutable copy of the object reference. Again, this has no effect on the mutability of the referenced data.

Noncompliant Code Example (Mutable Class, final Reference)

In this noncompliant code example, the programmer has declared the reference to the point instance to be final under the incorrect assumption that doing so prevents modification of the values of the instance fields x and y. The values of the instance fields can be changed after their initialization because the final clause applies only to the reference to the point instance and not to the referenced object.

...

When an object reference is declared final, it signifies only that the reference cannot be changed; the mutability of the referenced object is unaffected.

Compliant Solution (final Fields)

When the values of the x and y members must remain immutable after their initialization, they should be declared final. However, this invalidates a set_xy() method because it can no longer change the values of x and y.

...

With this modification, the values of the instance fields become immutable and consequently match the programmer's intended usage model.

Compliant Solution (Provide Copy Functionality)

If the class must remain mutable, another compliant solution is to provide copy functionality. This compliant solution provides a clone() method in the final class Point, avoiding the elimination of the setter method.

...

The Point class is declared final to prevent subclasses from overriding the clone() method. This enables the class to be suitably used without any inadvertent modifications of the original object. This solution also complies with OBJ04-J. Provide mutable classes with copy functionality to safely allow passing instances to untrusted code.

Noncompliant Code Example (Arrays)

This noncompliant code example uses a public static final array, items.

...

Clients can trivially modify the contents of the array, even though declaring the array reference to be final prevents modification of the reference itself.

Compliant Solution (Index Getter)

This compliant solution makes the array private and provides public methods to get individual items and array size. Providing direct access to the array objects themselves is safe because String is immutable.

private static final String[] items = {/* ... */};

public static final String getItem(int index) {
  return items[index];
}

public static final int getItemCount() {
  return items.length;
}

Compliant Solution (Clone the Array)

This compliant solution defines a private array and a public method that returns a copy of the array.

...

As before, this method provides direct access to the array objects themselves, which is safe because String is immutable. If the array contained mutable objects, the getItems() method could return a cloned array of cloned objects.

Compliant Solution (Unmodifiable Wrappers)

This compliant solution declares a private array from which a public immutable list is constructed.

...

Neither the original array values nor the public list can be modified by a client. For more details about unmodifiable wrappers, refer to SEC57-J. Provide sensitive mutable classes with unmodifiable wrappers. This solution still applies if the array contains mutable items instead of String.

Risk Assessment

Incorrectly assuming that final references cause the contents of the referenced object to remain mutable can result in an attacker modifying an object thought by the programmer to be immutable.

Related Guidelines

Bibliography

...