...
The problem is alleviated by creating a copy of the mutable input and using it to perform operations so that the original object is left unscathed. This can be realized by implementing the java.lang.Cloneable interface and declaring a public clone method if the class is final or by using a copy constructor. Performing a manual copy of object state within the caller becomes necessary if the mutable class is declared final (that is, it cannot provide an accessible copy method). See the guideline OBJ10-J. Provide mutable classes with a clone method copy functionality to allow passing instances to untrusted code safely for more information. Note that any input validation must be performed on the copy and not the original object.
...