It's a potential source of bugs for applications who write code like:

  new ConnectionString(...).getCredentialList().add(...);

thinking that a credential is added to the list. But ConnectionString is actually immutable, and getCredentialList returns a new ArrayList each time it's called, making that call a no-op.

The getCredentialList implementation should be updated to return an immutable list so that the above code results in a runtime exception, and the documentation should be updated to reflect that.

The ConnectionString class should also be annotated with @Immutable.