conjure-java
conjure-java copied to clipboard
Object builders allow sneaky mutations of maps inside created POJOs
conjure-java generates Builder classes for plain object types, which contain mutable collections (e.g. HashMap, ArrayList, HashSet). In the .build() method, we pass these mutable collections to the POJO's constructor, which uses Collections.unmodifiableMap(...) to prevent mutations from POJO methods HOWEVER, the builder still has references to the underlying mutable collections, so these can still be mutated!
Foo:
fields:
keys: map<string, integer>
@Test
public void sad() {
Foo.Builder builder = Foo.builder();
Foo schema = builder.build(); // create a Foo containing an empty 'keys' map
builder.keys("this call mutates a underlying list", 1234);
assertThat(schema.getKeys()).isEmpty(); // <- 🔥🔥 this fails
}
Reported by @j-baker