org.jbpm.taskmgmt.exe.TaskMgmtInstance.getTaskInstances() should return a clone or an unmodifiable view, otherwise documentation should explain it does not ----------------------------------------------------------------------------------------------------------------------------------------------------------- Key: JBPM-1912 URL: https://jira.jboss.org/jira/browse/JBPM-1912 Project: JBoss jBPM Issue Type: Bug Security Level: Public (Everyone can see) Components: API Affects Versions: jBPM 3.3.0 GA Reporter: Mauro Molinari The method org.jbpm.taskmgmt.exe.TaskMgmtInstance.getTaskInstances() returns directly the set internally used by the TaskMgmtInstance instance to track task instances, without cloning it. This can cause client code to corrupt that set (adding or removing elements in it) and corruption is "propagated" to all the task instances that share the same TaskMgmtInstance instance. I think that method should return a clone or an unmodifiable view of that set, otherwise the Javadoc should state clearly that it does not, warning the client programmer of the inherent risks. A similar rule may apply to org.jbpm.taskmgmt.exe.TaskMgmtInstance.getTaskInstancesWithVariableUpdates() too. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira