packageurl-java icon indicating copy to clipboard operation
packageurl-java copied to clipboard

#150 Prevent invalid URL generation

Open nhumblot opened this issue 1 year ago • 0 comments

Hi! :wave:

:warning: This PR is my first proposal to this code base, please add the necessary extra care as I may not have a deep knowledge of it

Fix #150

As per its JavaDoc, PackageURL.percentEncode(String) is expected to encode the input in conformance with RFC 3986.

Regarding encoding, the specification states the following:

A percent-encoding mechanism is used to represent a data octet in a component when that octet's corresponding character is outside the allowed set or is being used as a delimiter of, or within, the component. A percent-encoded octet is encoded as a character triplet, consisting of the percent character "%" followed by the two hexadecimal digits representing that octet's numeric value. For example, "%20" is the percent-encoding for the binary octet "00100000" (ABNF: %x20), which in US-ASCII corresponds to the space character (SP). Section 2.4 describes when percent-encoding and decoding is applied.

When introducing a newline \n in the version field, it appears to be encoded as %A and makes the URL invalid, the good value being %0A

This PR aims to improve this requirement by checking the length of the hexadecimal encoded value and add a leading 0 when needed.

Your comments are welcomed, thank you for your time contributing to this project! :pray:

nhumblot avatar Jun 01 '24 18:06 nhumblot