add an alternate version of EI_EXPOSE_REP

[xenoterracide]

add an alternate version of EI_EXPOSE_REP

[ThrawnCA]

Essentially this is only a security vulnerability if someone has added malicious code to your jvm.

That type of security concern tends to originate from the heyday of Java Applets.

[xenoterracide]

Yeah, but there's also that one where You can execute arbitrary toad if you throw an exception in the constructor... Either way my point is that mutable objects are actually also a bad coding practice (arguably), and generally would be better to replace with builder, record, and or effectively final objects (kind of what I'm talking here). It occurs to me I didn't think to mention builder since the builder itself is usually mutable so that would have to be recognized in some way although you could just suppress the class I suppose...

[ThrawnCA]

You can execute arbitrary toad

https://content.api.news/v3/images/bin/8b236653aec2926939f9bf4c695efbda?width=1024 happens ;)

Either way my point is that mutable objects are actually also a bad coding practice (arguably)

That's rather beyond the scope of what SpotBugs will ever enforce.

[xenoterracide]

Is it though? I mean it's something that spot bugs can do analysis on and already is. Really all I'm asking for is the ability to check but only check for public APIs. It's the same as this security vulnerability I just want to limit it to public APIs.