package-url / packageurl-python

Python implementation of the package url spec. This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ , the Google Summer of Code, nexB and other generous sponsors.
73 stars 47 forks source link

Need to tighten encoding handling for some types. #180

Open pombredanne opened 1 month ago

pombredanne commented 1 month ago

This is problematic:

>>> P.from_string("pkg:pypi/foo:bar@1.2.3")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/tmp/purl/venv/lib/python3.10/site-packages/packageurl/__init__.py", line 508, in from_string
    raise ValueError(msg)
ValueError: Invalid purl 'pkg:pypi/foo:bar@1.2.3' cannot contain a "user:pass@host:port" URL Authority component: ''.
>>> P.from_string("pkg:maven/com.apache:foo/foobar@1.2.3")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/tmp/purl/venv/lib/python3.10/site-packages/packageurl/__init__.py", line 508, in from_string
    raise ValueError(msg)
ValueError: Invalid purl 'pkg:maven/com.apache:foo/foobar@1.2.3' cannot contain a "user:pass@host:port" URL Authority component: ''.
>>> P.from_string("pkg:maven/com.apache$3Afoo/foobar@1.2.3")
PackageURL(type='maven', namespace='com.apache$3Afoo', name='foobar', version='1.2.3', qualifiers={}, subpath=None)
>>> P.from_string("pkg:maven/com.apache%3Afoo/foobar@1.2.3")
PackageURL(type='maven', namespace='com.apache:foo', name='foobar', version='1.2.3', qualifiers={}, subpath=None)
>>> str(P.from_string("pkg:maven/com.apache%3Afoo/foobar@1.2.3"))
'pkg:maven/c
om.apache:foo/foobar@1.2.3'

See also https://github.com/package-url/purl-spec/issues/39

pombredanne commented 1 month ago

We cannot round trip:

>>> from packageurl import PackageURL as P
>>> P.from_string(str(P.from_string("pkg:maven/com.apache%3Afoo/foobar@1.2.3")))
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/tmp/purl/venv/lib/python3.10/site-packages/packageurl/__init__.py", line 508, in from_string
    raise ValueError(msg)
ValueError: Invalid purl 'pkg:maven/com.apache:foo/foobar@1.2.3' cannot contain a "user:pass@host:port" URL Authority component: ''.