...
Similarly, a final method parameter obtains an immutable copy of the object reference; once again, this lacks any effect on the mutability of the referenced data.
Noncompliant Code Example (Mutable Class, final Reference)
In this noncompliant code example, the programmer has declared the reference to the point instance to be final, under the incorrect assumption that this prevents modification of the values of the instance fields x and y. Nevertheless, the values of the instance fields can be changed after their initialization because the final clause applies only to the reference to the point instance and not the referenced object.
...
When an object reference is declared final, it signifies only that the reference cannot be changed; the mutability of the referenced object remains unaffected.
Compliant Solution (final Fields)
When the values of the x and y members must remain immutable after their initialization, they should be declared final. However, this obviates the need for the setter method set_xy().
...
With this modification, the values of the instance fields become immutable and consequently match the programmer's intended usage model.
Compliant Solution (Provide Copy Functionality)
If the class must remain mutable, another compliant solution is to provide copy functionality. This compliant solution provides a clone() method in the final class Point; avoiding the elimination of the setter method.
...
The Point class is declared final to prevent subclasses from overriding the clone() method. This enables the class to be suitably used without any inadvertent modifications of the original object. This compliant solution complies with guideline OBJ10-J. Provide mutable classes with copy functionality to allow passing instances to untrusted code safely.
Noncompliant Code Example (Arrays)
This noncompliant code example uses a public static final array, items.
...
Clients can trivially modify the contents of the array, even though declaring the array reference to be final prevents modification of the reference itself.
Compliant Solution (Clone the Array)
This compliant solution defines a private array and a public method that returns a copy of the array.
...
Consequently, the original array values cannot be modified by a client. Note that a manual deep copy could be required when dealing with arrays of objects. This generally happens when the objects do not export a clone() method. Refer to guideline FIO00-J. Defensively copy mutable inputs and mutable internal components for more information.
Compliant Solution (Unmodifiable Wrappers)
This compliant solution declares a private array from which a public immutable list is constructed.
...
Neither the original array values nor the public list can be modified by a client. For more details about unmodifiable wrappers, refer to guideline SEC14-J. Provide sensitive mutable classes with unmodifiable wrappers.
Risk Assessment
Incorrectly assuming that final references cause the contents of the referenced object to remain mutable can result in an attacker modifying an object thought by the programmer to be immutable.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
OBJ01-J | low | probable | medium | P4 | L3 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
Related Guidelines
MITRE CWE: CWE-607 "Public Static Final Field References Mutable Object"
Bibliography
| Wiki Markup |
|---|
\[[Bloch 2008|AA. Bibliography#Bloch 08]\] Item 13: Minimize the accessibility of classes and members \[[Core Java 2004|AA. Bibliography#Core Java 04]\] Chapter 6 \[[JLS 2005|AA. Bibliography#JLS 05]\] Sections [4.12.4 "final Variables"|http://java.sun.com/docs/books/jls/third_edition/html/typesValues.html#4.12.4] and [6.6 "Access Control"|http://java.sun.com/docs/books/jls/third_edition/html/names.html#6.6] |
...