title: Malicious code vulnerability - May expose internal representation by returning reference to mutable object - With what objects?
body: <p>I'm getting the following violation reported by Sonar: May expose internal representation by returning reference to mutable object.</p>
  
  <p>It's because I'm returning a String[] from a getter.</p>
  
  <p>I know what the problem is and how to solve it but going through several thread on stackoverflow I noticed that seems to be happen for String[] and Dates for example:</p>
  
  <p><a href="https://stackoverflow.com/questions/8951107/malicious-code-vulnerability-may-expose-internal-representation-by-returning-r">Malicious code vulnerability - May expose internal representation by returning reference to mutable object</a></p>
  
  <p><a href="https://stackoverflow.com/questions/18954873/malicious-code-vulnerability-may-expose-internal-representation-by-incorporati">Malicious code vulnerability - May expose internal representation by incorporating reference to mutable object</a></p>
  
  <p>But given the reason why that happens which is returning a reference to an object whose internal state could be changed by the caller. Shouldn't that violation be raised for every getter returning a mutable object?</p>
  
  <p>For example:</p>
  
  <pre><code>public List&lt;String&gt; getList() { return list; }
  
  public Foo getFoo() { return foo; } //where foo is just a random object with getters and setters...
  </code></pre>
  
  <p>The caller could change the state of the returned objects. Shouldn't sonar report the same for those?</p>
  
  <p>Many thanks,
  Francisco.</p>