fix: escape / in names and versions

[melotic]

This will properly escape slashes in both names and versions of packages.

In addition, I've synced the tests with the ones in https://github.com/package-url/packageurl-dotnet.

[matt-phylum]

AFAIK / in the name is generally forbidden. Escaping it seems reasonable, but it's not part of the spec. Some implementations support it.

althonos/packageurl.rs: pkg:npm/a/b
anchore/packageurl-go: pkg:npm/a/b
giterlizzi/perl-URI-PackageURL: pkg:npm/a/b
maennchen/purl: pkg:npm/a/b
package-url/packageurl-dotnet: pkg:npm/a%2Fb
package-url/packageurl-go: pkg:npm/a%2Fb
package-url/packageurl-java: pkg:npm/a%2Fb
package-url/packageurl-js: pkg:npm/a%2Fb
package-url/packageurl-php: pkg:npm/a/b
package-url/packageurl-python: pkg:npm/a/b
package-url/packageurl-ruby: pkg:npm/a%2Fb
package-url/packageurl-swift: pkg:npm/a/b
phylum-dev/purl: pkg:npm/a%2Fb
sonatype/package-url-java: pkg:npm/a%2Fb

/ in the version is not supposed to be escaped, but there are no tests for it and some implementations implement parsing incorrectly.

althonos/packageurl.rs: {"type": "npm", "name": "a", "version": "b/c"}
anchore/packageurl-go: {"type": "npm", "name": "c", "namespace": "a@b"}
giterlizzi/perl-URI-PackageURL: {"type": "npm", "name": "a", "version": "b/c"}
maennchen/purl: {"type": "npm", "name": "c", "namespace": "a@b"}
package-url/packageurl-dotnet: {"type": "npm", "name": "a", "version": "b/c"}
package-url/packageurl-go: {"type": "npm", "name": "c", "namespace": "a@b"}
package-url/packageurl-java: {"type": "npm", "name": "a", "version": "b/c"}
package-url/packageurl-js: {"error": "Error: Invalid purl: version must be percent-encoded"}
package-url/packageurl-php: {"type": "npm", "name": "a", "version": "b/c"}
package-url/packageurl-python: {"type": "npm", "name": "a", "version": "b/c"}
package-url/packageurl-ruby: {"type": "npm", "name": "a", "version": "b/c"}
package-url/packageurl-swift: {"type": "npm", "name": "a", "version": "b/c"}
phylum-dev/purl: {"type": "npm", "name": "c", "namespace": "a@b"}
sonatype/package-url-java: {"type": "npm", "name": "a", "version": "b/c"}

In addition, I've synced the tests with the ones in https://github.com/package-url/packageurl-dotnet.

The tests come from https://github.com/package-url/purl-spec/blob/master/test-suite-data.json .

[jkugler]

AFAIK / in the name is generally forbidden. Escaping it seems reasonable, but it's not part of the spec. Some implementations support it.

Yes, I would say the spec is somewhat ambiguous. The spec does say this:

name:

• The name is prefixed by a '/' separator when the namespace is not empty
• This '/' is not part of the name
• A name must be a percent-encoded string

The second line refers to the separator. And given that the name must be a percent-encoded string, I would think a / would be allowed. Either way, the spec needs clarifying. :)

[matt-phylum]

I mean, I don't think there's a package type which allows slashes in the name, and I don't think it would be a good idea to make a package type that would include slashes in the name. The implementations should do something consistent and the tests in the spec should specify what that is.

[jkugler]

In the spec, no, there isn't a package type that has / in the name. But because of how we're using PURLs internally at $job, there are / in the names. Given the the spec says to "append the percent-encoded {name|version} to the purl," when building the purl, I think it's reasonable that packageurl-python do so.

[jkugler]

Just thought of another use case that might want slashes in the name. If a company is using a monorepo with multiple product in one repo, you might have, say, github/org/repo_name/product_name where the actual name would be "repo_name/product_name."

[jkugler]

These should actually use urllib.parse.quote(the_string, safe='')

[pombredanne]

Thanks for all this. We are in the last leg of clarifying the encoding of namespace/name and version in the spec and I'll review this as soon as this is completed!

[martonilles]

In ECMA-427

5.6.4 Name:

• The name is prefixed by a single slash '/' separator when the namespace is not empty.
• All leading and trailing slashes '/' are not significant and should be stripped in the canonical form. They are
  not part of the name.
• A name shall be a percent-encoded string.
• When percent-decoded, a name may contain any Unicode character unless the package's type definition
  provides otherwise

According to this name could contain any unicode, including slash (/) so percent-encoding should be OK for name to avoid conflict with namespace.

Currently it is broken on a roundtrip:

>>> PackageURL.from_string(PackageURL(type='generic', namespace='vendor/with/slash', name='product/slashed').to_string())
PackageURL(type='generic', namespace='vendor/with/slash/product', name='slashed', version=None, qualifiers={}, subpath=None)

One way is OK:

>>> PackageURL.from_string("pkg:generic/vendor/with%2fslash/product%2fslash")
PackageURL(type='generic', namespace='vendor/with/slash', name='product/slash', version=None, qualifiers={}, subpath=None)