Is it acceptable to use a private object?

[saul_2110]

Hi. I have a doubt; in the code below, object B is using (but not modifying) a private member of A. Is that acceptable for java's style of programming?

public class C1
{
   private Connection conn;

   C1()
   { 
      Class.forName("com.mysql.java.Driver").newInstance();
      conn = DriverManager.getConnection("jdbc:...","user","password");
   }

   public Connection getConn() { return conn; }

   public static void main(String[] args)
   {
      C1 A = new C1();
      C2 B = new C2();

      B.getFromDatabase( A.getConn() );
   }
}

class C2
{
   public void getFromDatabase(Connection conn)
   {
      Statement stmt = conn.createStatement(); // <-- Use of private member of class C1
      ResultSet rs = stmt.executeQuery( "SELECT * FROM STATES" );
      /* do something clever */
      rs.close();
      stmt.close();
   }   
}

Note: I removed the import statements and exception handling on purpose.

[emceenugget]

what happens when you compile it?

[saul_2110]

Initially I had just compiled it and it was OK. To be sure, I connected to the actual DB and retrieved data. It worked OK, too.

The question left is whether it is a good programming style or should it be avoid?

[timkd127]

iv'e never heard of a private aggregate field being bad style, but if you dont like it you could add a copy constructor to the Connection class and pass a copy to the class your working in. Ex

public Connection(Connection i ){

conn.field=field;//field being a field of the Connection class, use as many as neccessary.
}
use that constructor to initialize the aggregate object and that will take care of the security hole so you dont have to use a private field.

[emceenugget]

Looking over your code, I think you might wanna look at it from a different angle.

Do you know about the "static" modifier? Just wondering, because after looking at your code, it seems like it would make more sense to take advantage of class variables and methods.

If you don't, then read up on it. Basically "static" variables and methods belong to the whole class (there is only one of each), while non-static (instance) variables and methods belong to the specific instance of the class (and there exist one for each object created).

[saul_2110]

The problem I "feel" that exists in the code is that "Class C1 is giving access of its private object X to other classes, by means of the getter method of X"... (where X is "conn" in the example)

Now, the reason I feel this is a problem is that, in general, having a getter method for a private object member exposes its public interface, as if it were declared public in the class... and that is a security hole [isn't it?]

The existance of that security hole would make it a bad programming style or at least a bad practice, right?

In the example, by exposing A's private member "conn", object B (of class C2) is able to close A's connection with the DB.

[xcallmejudasx]

Well you have to work with getter methods if you want to use a private attribute. As long as your not using any setter methods you should be fine. Take a bank account and account number for example.

The account number has to be private because we obviously don't want people changing their account numbers around, but we also need to be able to see what it so that money can be deposited into the right account. If accountNumber was public we could easily change it using

instanceOfClass.accountNumber = myAccountNumber

whereas if it were private

instanceOfClass.getAccountNumber() = myAccountNumber

would throw errors since getAccountNumber would only return the string representation of that number(not the actual string attribute attached to that object)

[xcallmejudasx]

Oh and to actually answer your question yes it should be perfectly acceptable(unless your employee is super crazy on program security and wants absolutely no reference to private fields)

Also something to note; if DriverManager is a class you made be wary what fields you make available using getters.

A.getConn() can easily be made something.Decrypt(A.getConn().getUser().getPasswor d())

[saul_2110]

Well you have to work with getter methods if you want to use a private attribute.

Well, in the case of primitive attributes it would be OK as you showed in the bank example, but what if the attribute is an object, which has its own public interface.

In that scenario, anyone may misuse the public interface of the private object, like calling the close() method of the Connection object in the example code.