Page History

            Immutability helps to supporting security reasoning. It is safe to share immutable objects, without risk that the recipient can modify something that we are relying uponon \[java:[Mettler 2010B|AA. References#Mettler 2010B]\].

Programmers could incorrectly expect that declaring a field or variable {{final}} makes the referenced object immutable. Declaring variables that have a primitive type to be {{final}} does prevent changes to their values after initialization (unless the unsupported {{sun.misc.Unsafe}} class is used). However, when the variable has a reference type, the presence of a {{final}} clause in the declaration only makes _the reference itself_ immutable. The {{final}} clause has no effect on the referenced object. Consequently, the fields of the referenced object can be mutable. For example, according to the _Java Language Specification_ \[java:[JLS 2005|AA. References#JLS 05]\], [§4.12.4|http://java.sun.com/docs/books/jls/third_edition/html/typesValues.html#4.12.4], "{{final}} Variables,"

... if If a final variable holds a reference to an array, then the components of the array may be changed by operations on the array, but the variable will always refer to the same array.

...

In this noncompliant code example, the programmer has declared the reference to the point instance to be final, under the incorrect assumption that this doing so prevents modification of the values of the instance fields x and y. The values of the instance fields can be changed after their initialization because the final clause applies only to the reference to the point instance and not to the referenced object.

class Point {
  private int x;
  private int y;

  Point(int x, int y) {
    this.x = x;
    this.y = y;
  }
  void set_xy(int x, int y) {
    this.x = x;
    this.y = y;
  }
  void print_xy() {
    System.out.println("the value x is: " + this.x);
    System.out.println("the value y is: " + this.y);
  }
}

public class PointCaller {
  public static void main(String[] args) {
    final Point point = new Point(1, 2);
    point.print_xy();

    // change the value of x, y
    point.set_xy(5, 6);
    point.print_xy();
  }
}

...

With this modification, the values of the instance fields become immutable and , consequently , match the programmer's intended usage model.

...

The clone() method returns a copy of the original object that reflects the state of the original object at the moment of cloning. This new object can be used without exposing the original object. Because the caller holds the only reference to the newly cloned instance, the instance fields cannot be changed without the caller's cooperation. This use of the clone() method allows the class to remain securely mutable. (See rule " OBJ04-J. Provide mutable classes with copy functionality to safely allow passing instances to untrusted code.")

The Point class is declared final to prevent subclasses from overriding the clone() method. This enables the class to be suitably used without any inadvertent modifications of the original object. This solution also complies with rule " OBJ04-J. Provide mutable classes with copy functionality to safely allow passing instances to untrusted code."

Noncompliant Code Example (Arrays)

...

As a result, the original array values cannot be modified by a client. Note that a manual deep copy could be required when dealing with arrays of objects. This generally happens when the objects do not export a clone() method. Refer to rule "OBJ06-J. Defensively copy mutable inputs and mutable internal components" for more information.

As before, this method provides direct access to the array objects themselves, which is safe because String is immutable. If the array contained mutable objects, the getItems() method could return a cloned array of cloned objects.

...

Neither the original array values nor the public list can be modified by a client. For more details about unmodifiable wrappers, refer to rule " void SEC14-J. Provide sensitive mutable classes with unmodifiable wrappers. " This solution still applies if the array contains mutable items instead of String.

...

...