Do not expose references to mutable objects to client code. Never initialize such a field to a client-provided object reference or return the object reference from an accessor. Exposing a public static final object allows clients to modify the contents of the object (although they will not be able to change the object itself, as it is final).
This rule does not address private mutable objects, see rule OBJ05-J. Do not return references to private mutable class members for more information.
Noncompliant Code Example
...