...
OBJ01-J. Limit accessibility of fields points out that invariants cannot be enforced for mutable objects. TSM03-J. Do not publish partially initialized objects describes object construction and visibility issues specific to mutable objects, and CON50-J. Do not assume that declaring a reference volatile guarantees safe publication of the members of the referenced object and CON52-J. Document thread-safety and use annotations where applicable discuss some concurrency issues associated with mutable objects.
Violation of this recommendation can be mitigated by treating objects from untrusted sources as potentially malicious subclasses, as directed by OBJ06-J. Defensively copy mutable inputs and mutable internal components. Complying with that rule protects you from the consequences of violating this recommendation.
This example is particularly important because the BigInteger type has several useful cryptographic applications.
...
[API 2006] | Class |
Item 15: "Minimize mutability" Item 17, "Design and Document for Inheritance or Else Prohibit It" | |
Chapter 6, "Enforcing Security Policy" | |
[Lai 2008] | Java Insecurity, Accounting for Subtleties That Can Compromise Code |
Chapter 7, Rule 3, Make everything final, unless there's a good reason not to | |
| [SCG 2009] | Guideline 4-5 / EXTEND-5: Limit the extensibility of classes and methods |
| [Ware 2008] |
...