packageurl-java
packageurl-java copied to clipboard
Instanciating a PackagerURL with a version number containing a new line leads eventually to an invalid URL
Context
Identified following this analysis https://github.com/jeremylong/DependencyCheck/issues/6688#issuecomment-2138489883
Maven supports the newline character in the version as per its XSD. When instantiating a PackageURL with such a character in its version, calling PackageURL.canonicalize() returns an invalid URL.
Steps to reproduce
PackageURL url = new PackageURL("maven", "com.google.summit", "summit-ast", "2.2.0\n", null, null);
String canonicalize = url.canonicalize();
Expected beavior
canonicalize is equal to pkg:maven/com.google.summit/[email protected]%0A
Current behavior
canonicalize is equal to pkg:maven/com.google.summit/[email protected]%A