[TYPO3-core] RFC: Add external RemoveXSS library to TYPO3

[Patrick Broens]

Dmitry Dulepov [typo3] wrote:
> Michael Stucki wrote:
>> To me this looks exactly like it's a problem to include such code in a 
>> GPL (no matter if v2 or v3) project, even if the author has approved 
>> it so clearly.
>>
>> Since this looks so weird to me, the next question for me is:
>> Why should we care?
> 
> I think there is an answer here:
> http://www.gnu.org/licenses/gpl-faq.html#GPLModuleLicense
> 
> -------------
> Q: If I add a module to a GPL-covered program, do I have to use the GPL 
> as the license for my module?
> A: The GPL says that the whole combined program has to be released under 
> the GPL. So your module has to be available for use under the GPL.
> -------------
> 
> Module has to be available *for use* under GPL but it *does not have to 
> be* GPL itself! So we are free to go. We just have to say more precizely 
> in that file: the author has given *typo3 team* permission to use and 
> modify this piece of code in whatever way. "Used with permission" is not 
> very clear.
> 
> 
This is not "your" module! I think you misread this Q&A

I did some investigation about this issue and found the following:

Code which is published without a license at all is considered to be 
Public domain software under a proprietary license [1]. These licenses 
are not compliant with GPL, because the software is simply not "free", 
although we are allowed to use and redistribute it by permission.

But ... If the source code is in the public domain, which is (although 
there is some controversy that everything on the Internet is Public 
Domain, but look at the first sentence of the previous paragraph) and we 
are talking about source code here, it is a special case of 
"non-copylefted free software" [2]. This type of software comes from the 
author with permission to redistribute and modify. The author can add 
additional restrictions to it.

So, suddenly it became "free" software.

But that doesn't mean we can use it.
GPL is copylefted, the module is non-copylefted without a proper 
license. This still does not make it compatible with GPL.

We can't do a thing with it without some kind of license from the 
author, I think. Maybe there is someone in the community who knows more 
about this legal stuff then we do.

Patrick

[1] http://fly.isti.cnr.it/sl/licenses.html
[2] http://www.gnu.org/philosophy/categories.html