Page History

...

However, when the variable refers to a mutable object, the object's members that appear to be immutable, may could, in fact, be mutable. Similarly, a final method parameter obtains a copy of the object reference through pass-by-value, but the referenced data remains mutable.

According to the Java Language Specification \[[JLS 2005|AA. Bibliography#JLS 05]\], sectionSection 4.12.4, "{{final}} Variables"

... if a final variable holds a reference to an array, then the components of the array may be changed by operations on the array, but the variable will always refer to the same array.

...

In this noncompliant code example, the values of instance fields x and y can be changed even after their initialization, despite the point instance being declared as final.

class Point {
  private int x;
  private int y;

  Point(int x, int y){
    this.x = x;
    this.y = y;
  }
  void set_xy(int x, int y){
    this.x = x;
    this.y = y;
  }
  void print_xy(){
    System.out.println("the value x is: " + this.x);
    System.out.println("the value y is: " + this.y);
  }
}

public class PointCaller {
  public static void main(String[] args) {
    final Point point = new Point(1, 2);
    point.print_xy();

    // change the value of x, y
    point.set_xy(5, 6);
    point.print_xy();
  }
}

...

When x and y must remain immutable after their initialization, they should be declared as final. However, this requires the elimination of the setter method set_xy().

...

Clients can trivially modify the contents of the array, though, they are unable to change the array reference because it is final.

...

Consequently, the original array values cannot be modified by a client. Note that a manual deep copy may could be required when dealing with arrays of objects. This generally happens when the objects do not export a clone() method. Refer to guideline FIO00-J. Defensively copy mutable inputs and mutable internal components for more information.

...

Neither the original array values nor the public list can be modified by a client. For more details about unmodifiable wrappers, refer to guideline SEC14-J. Provide sensitive mutable classes with unmodifiable wrappers.

...

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Related Guidelines

MITRE CWE: CWE-607 "Public Static Final Field References Mutable Object"

Bibliography

\[[Bloch 2008|AA. Bibliography#Bloch 08]\] Item 13: Minimize the accessibility of classes and members
\[[Core Java 2004|AA. Bibliography#Core Java 04]\] Chapter 6
\[[JLS 2005|AA. Bibliography#JLS 05]\] Sections [4.12.4 "final Variables"|http://java.sun.com/docs/books/jls/third_edition/html/typesValues.html#4.12.4] and [6.6 "Access Control"|http://java.sun.com/docs/books/jls/third_edition/html/names.html#6.6]
\[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 607|http://cwe.mitre.org/data/definitions/607.html] "Public Static Final Field References Mutable Object"

...

OBJ00-J. Declare data members as private and provide accessible wrapper methods      08. Object Orientation (OBJ)      OBJ02-J. Do not ignore return values of methods that operate on immutable objects