Why is package access higher priviliged than protected?

Question

Hello,
why is the access level of fields and methods on package level higher priviliged than the 'protected' modifier? I am searching for a general answer to this behaviour, because I am writing my master's thesis about this.
How can I give subclasses access to fields without widing the access protection to the other package members? Shouldn't there be another access level 'in between' of default(package-private) and private, that gives access only to subclasses?
Example:
If you want to let a class be extended, than you have to set some fields from private to protected. Now a subclass has access to this field. Let's imagine a 'EvilClass' that wants to change the state of an object. EvilClass has only be to put in the same package and then EvilClass gains imidietly access to protected fields. The reason is, that protected gives access to subclasses AND to classes in the same package.
Thanks for any comment
Greetings, Timo

Answer 1

TimoMeinen wrote:
Thank you for your replies. But I am still not satisfied with this logic.
In C++ the protected keyword has exactly the meaning of "access to subclasses" becauser there is no "compilation unit"-philosophy like the package system in Java. C++ is using friends-classes for this.So what? This is Java and not C++. Classes in the same package are friends.
And yes, you're obviously right to say, that packages are closer than subclasses, but I think there are a lot of examples, where a stricter access level would be fine.No
>
I think of the "Visitor Pattern" for example, which often has to reduce the access level, so that visitors are able to do their job. Or, OR-Mapping Tools, which aren't allowed to use reflections to fill the private fields of entities. A (friend=hibernate) would be nice. ;-)You can populate a private field using reflection, but I would probably use cglib or asm or any other library to create subclasses during loading.
>
Another 'evil'-idea: What about somenone wants to attack me. He is able to gain access to 'my' protected fields, just by define an 'attackclass' in the same package. So, the only possibilty to deny such attacks is by sealing my jars?Is that an attack? Sounds just like something stupid. It would be much easier to replace your class with another one.