packageurl-java
packageurl-java copied to clipboard
Slash character is not expected to be escaped by the specification
This issue is created following https://github.com/package-url/purl-spec/discussions/293
Slash character in qualifiers appears to be escaped in the current implementation. For example the following code
//DEPS com.github.package-url:packageurl-java:1.5.0
import java.util.TreeMap;
import com.github.packageurl.PackageURL;
public class purl {
public static void main(String[] args) throws Exception {
final TreeMap<String, String> qualifiers = new TreeMap<>();
qualifiers.put("type", "jar");
qualifiers.put("repository_url", "https://maven.repository.redhat.com/ga/");
var purl = new PackageURL(PackageURL.StandardTypes.MAVEN,
"org.apache.james",
"apache-mime4j-storage",
"0.8.9.redhat-00001",
qualifiers, null);
System.out.println(purl);
}
}
results in
pkg:maven/org.apache.james/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar
while following the spec it should be
pkg:maven/org.apache.james/[email protected]?repository_url=https://maven.repository.redhat.com/ga/&type=jar
Not necessarily, see https://github.com/package-url/purl-spec/issues/39.
Converting ':' to "%3A" and '/' to "%2F" is perfectly valid and matches java.net.URLEncoder, but it's unfortunate that the "canonical" representation cannot be agreed on by the implementations.
The current test suite does not encode these characters.