Careeroza

Defensive Copies

Leaking Internal Lists

A getter that returns an internal List lets callers modify your private data. Return a read-only view or a copy instead.

Example

import java.util.ArrayList;
import java.util.Collections;
import java.util.List;

public class Main {
    public static void main(String[] args) {
        Classroom c = new Classroom();
        c.addStudent("Asha");
        c.addStudent("Ravi");

        List<String> view = c.getStudents();
        try {
            view.add("Hacker");
        } catch (UnsupportedOperationException e) {
            System.out.println("Cannot modify from outside");
        }
        System.out.println(c.getStudents());
    }
}

class Classroom {
    private final List<String> students = new ArrayList<>();

    public void addStudent(String name) {
        students.add(name);
    }

    public List<String> getStudents() {
        return Collections.unmodifiableList(students);
    }
}

Output

Cannot modify from outside
[Asha, Ravi]