packageurl-java icon indicating copy to clipboard operation
packageurl-java copied to clipboard

Slash character is not expected to be escaped by the specification

Open aloubyansky opened this issue 1 year ago • 2 comments

This issue is created following https://github.com/package-url/purl-spec/discussions/293

Slash character in qualifiers appears to be escaped in the current implementation. For example the following code

//DEPS com.github.package-url:packageurl-java:1.5.0

import java.util.TreeMap;
import com.github.packageurl.PackageURL;

public class purl {
    public static void main(String[] args) throws Exception {

        final TreeMap<String, String> qualifiers = new TreeMap<>();
        qualifiers.put("type", "jar");
        qualifiers.put("repository_url", "https://maven.repository.redhat.com/ga/");
        var purl = new PackageURL(PackageURL.StandardTypes.MAVEN,
                    "org.apache.james",
                    "apache-mime4j-storage",
                    "0.8.9.redhat-00001",
                    qualifiers, null);
        System.out.println(purl);
    }
}

results in

pkg:maven/org.apache.james/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar

while following the spec it should be

pkg:maven/org.apache.james/[email protected]?repository_url=https://maven.repository.redhat.com/ga/&type=jar

aloubyansky avatar Mar 06 '24 09:03 aloubyansky

Not necessarily, see https://github.com/package-url/purl-spec/issues/39.

Converting ':' to "%3A" and '/' to "%2F" is perfectly valid and matches java.net.URLEncoder, but it's unfortunate that the "canonical" representation cannot be agreed on by the implementations.

dwalluck avatar Feb 20 '25 20:02 dwalluck

The current test suite does not encode these characters.

dwalluck avatar Feb 27 '25 01:02 dwalluck