Page History

A nested class is any class whose declaration occurs within the body of another class or interface [JLS 20052015]. The use of a nested class is error - prone unless the semantics are well understood. A common notion is that only the nested class may access the contents of the outer class. Not only does the nested class have access to the private fields of the outer class, but the same fields can be accessed by any other class within the package when the nested class is declared public or if it contains public methods or constructors. As a result, the nested class must not expose the private members of the outer class to external classes or packages.

According to the The Java Language Specification (JLS), §8.3, "Field Declarations" [JLS 20052015]:

Note that a private field of a superclass might be accessible to a subclass (for example, if both classes are members of the same class). Nevertheless, a private field is never inherited by a subclass.

...

Compliant Solution

Use the private access specifier to hide the inner class and all contained methods and constructors.

class Coordinates {
  private int x;
  private int y;

  private class Point {
    private void getPoint() {
      System.out.println("(" + x + "," + y + ")");
    }
  }
}

class AnotherClass {
  public static void main(String[] args) {
    Coordinates c = new Coordinates();
    Coordinates.Point p = c.new Point();    // failsFails to compile
    p.getPoint();
  }
}

...

The Java language system weakens the accessibility of private members of an outer class when a nested inner class is present, which can result in an information leak.

Automated Detection

Automated detection of nonprivate inner classes that define nonprivate members and constructors that leak private data from the outer class is straightforward.

Related Guidelines

Bibliography

...

...