Invalid purls when scanning Rust(cargo) repository

[kennylam91]

Hi guys, When I scan a Rust(cargo) repository (e.g https://github.com/rust-lang/rustlings), the sbom file result contains these purls:

pkg:cargo//ryu@1.0.17#
pkg:cargo//which@6.0.1#
pkg:cargo//hashbrown@0.14.3#
pkg:cargo//anstream@0.6.13#
pkg:cargo//regex-automata@0.4.6#

As per purl-specification, these purls seem not to be valid with // And when extracting them, the name info would include a slash (e.g /ryu instead of ryu)

[annaowens]

Adding @FernandoRojo to help on this issue.