If security checks are based on untrusted sources, it may be becomes possible to bypass them. It is allowable recommended to defensively copy the untrusted object or parameter before the security check is carried out. For this purpose deep copies must be created as opposed to using the clone() method to create shallow copies (MET39-J. Do not use the clone method to copy untrusted method parameters). Also see the related guideline FIO31-J. Defensively copy mutable inputs and mutable internal components.
...
This noncompliant code example describes a security vulnerability from JDK 5.0 software. At the time, java.io.File was non-final, allowing an attacker to supply an untrusted value as a parameter which was constructed by extending the legit java.io.File class. In this way, the getPath() method can could be overridden so that the security check passes the first time it is called but the value mutates the second time to refer to a sensitive file such as /etc/passwd. This is a time of check, time of use (TOCTOU) vulnerability.
...
Security checks should not be based on untrusted sources. This compliant solution ensures that the java.io.File object cannot be untrusted. This is achieved by declaring java.io.File as final and ensuring that a new java.io.File object is created in the openFile() method. Note that using the clone() method instead, would copy the attacker's class which is not desirable (refer to MET39-J. Do not use the clone method to copy untrusted method parameters).
...