Skip to content

A getter that breaks encapsulation

```java class Student { private List<String> courses = new ArrayList<>(); public List<String> getCourses() { return courses; } }

Student s = new Student(); s.getCourses().add("hacked"); ```

The field is private and there is no setter. Why did that work?