What is inside com.sun package?

It contains Sun Oracle reference implementations of the standard Java (EE) APIs. Among others Mojarra (the reference JSF implementation of Oracle) and Glassfish (the reference Java EE implementation of Oracle) use this package. It's preferable to not use those classes directly in your code as it would make your code tight coupled to the implementation. Coding against the java(x) API directly enables you to change the implementation without changing your code (e.g. MyFaces instead of Mojarra and JBoss AS instead of Glassfish). Also JDK's own HttpServer sits in the com.sun.* package, see Simple HTTP server in Java using only Java SE API.

Please note that the com.sun.* package should not be confused with sun.* package which are the internal classes behind Oracle JRE which you should absolutely not import/use in your code as it would make your code tight coupled to the JRE make/version. Not using sun.* package at all enables you to run your code on all other JRE implementations (OpenJDK, GCJ, etc).

There are many places which use com.sun packages (some of which are mentioned in other answers). This answer just specifically addresses the use of com.sun within JavaFX. JavaFX is a UI library which is part of OpenJDK.

A lot of the JavaFX implementation is in com.sun classes. When JavaFX was open sourced, the following comment was made by the JavaFX developers regarding the use of com.sun classes within JavaFX:

As always, non-public API (or rather, unsupported API, meaning anything that is not in the javafx namespace such as com.sun.*) cannot be depended on from release to release. But for those of you wondering how things work, there is some very important stuff buried in the unsupported packages, and for those of you wanting to actually hack on OpenJFX, this will be of even greater interest.