...
Likewise, if a static method has the synchronized keyword, the intrinsic lock of the Class object is obtained, and released when the method completes. The same restrictions listed above apply to static methods, since any untrusted code that can access an object of the class, or a subclass, can use the getClass() method to obtain access to the Class object. Furthermore, hostile code must not be able to access the Class object at all. This could be accomplished, for instance, by making the class package-private.
This rule can be considered guideline is an extension of CON02-J. Always synchronize on the appropriate object. This rule covers method synchronization, which is synchronization on the this and is fully compliant with it. It recommends block synchronization using an internal private lock object instead of synchronizing on the this reference of the class object.
Noncompliant Code Example
...