License conflit

[grantcv1]

I use this package in my application assuming the MIT license. We just submitted the code for a security audit and they came back pointing out that there are three direct attributed copies from an answer to a Stack Overflow question. This is problematic in that it could change the license terms to the terms of Creative Commons imposed by Stack Overflow.

[UziTech]

Can you share the three copies?

I don't think it will be an issue since CC is a permissive license so other than attributing the code there shouldn't be anything else we need to do.

[grantcv1]

The three references that the software audit discovered are:

marked.esm.js - line 283
marked.umd.js - line 359
helpers.js - line 241

The comment we got back is:

"They point out that any content posted to Stackoverflow is under the “Creative Commons Attribution Share Alike” license as per the website terms and are raising the consideration that the nature of that license would mean that Marked would also fall under this license."

The concern raised by legal at our customer is that this might then flow to our code and consequently on to their code.

It looks to me like it's a tiny snippet of code. Could that code be rewritten such that the attribution isn't necessary (I always thought that attribute was a good thing and never dreamed this would come up) and wouldn't spook legal.

Thanks for getting back so fast.

-Grant

[UziTech]

What version of marked are you using? those lines in the latest version are definitely not from stackoverflow.

I'm not a lawyer but I know the cc-by-sa license allows for commercial use. I believe the license just says that that code would still be licensed under cc-by-sa if it is modified. The rest of the code can be under any other license.

Could that code be rewritten such that the attribution isn't necessary

I don't think attribution is a problem since MIT also requires attribution. If attribution is a problem than you can't use almost any open source code.

[calculuschild]

The three references that the software audit discovered are:

marked.esm.js - line 283 marked.umd.js - line 359 helpers.js - line 241

None of these files even exist anymore in the current version of the repository. But looking back in the history, these are things like:

if (count < 1) {

I can't imagine how that could possibly be considered "taken from Stackoverflow". If all they have found are 3 individual lines of code in separate files, I don't think you can meaningfully say that any source "owns" that code under any kind of license.

Also note that marked.esm.js and marked.umd.js are automatically compiled packages (which include helpers.js inside). So that's one single line of code being detected 3 times.

[UziTech]

Looks like it is probably this line, which is no longer in the latest version. So my suggestion would be to update marked and you should be fine. Also there is attribution with a link so that should also be fine.

marked/src/helpers.js

Line 258 in 95f37bd

// copied from https://stackoverflow.com/a/5450113/806777

[grantcv1]

Ok, thanks. I'll update it.