Security problem about public modifier.

Question

1. there are two classes exist in the different package, let's say, Class A in package com.a, and class B in com.b, there is a public(is a must) function in B which is only open to A, we don't want it to be published to the end user when we generate the api-docs, how should i do now?
2. since the class files and the java files are matched one by one, how can i be sure that the class IS the class i write, not the one replaced by the others?
much thanks.

Answer 1

This sounds a lot more like an "incomplete understanding of Java" problem than a "Security General" problem - but anyway...
1. there are two classes exist in the different
package, let's say, Class A in package com.a, and
class B in com.b, there is a public(is a must)
function in B which is only open to A, we don't want
it to be published to the end user when we generate
the api-docs, how should i do now?Are A and B in the same package? If so, then make B.protectedButPublicMethod() be package-protected.
Is any of B accessible to end-users? If not, then define B inside of A.java as a non-public class. Javadoc will then ignore B's methods (unless you go out of your way to tell it to produce the docs for B).
Java isn't C++ - there are no "friends" in Java. Package-protected comes closest.
2. since the class files and the java files are
matched one by one, how can i be sure that the class
IS the class i write, not the one replaced by the
others?.class and .java are NOT matched "one by one". A.java can only contain one public class, but it can also contain an arbitrary number of non-public classes and inner classes.
However, that is a separate issue from your second question. And the net is, you can't prevent your end-user from replacing your classfiles with their own.
Note that this isn't a Java-specific problem - it affects any system that allows dynamic libraries (like, say, .dlls on Windows or .so's on Unix).
Whatever it is you're trying to protect, I think you need to seriously rethink your approach - your questions hint at a system that is, at best, naive.
Good luck!
Grant