aboutcode-org / aboutcode-org/purldb

Public purldb API appears to ignore subpaths when submitted as part of a URL

Offen
#536 2 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
bug documentation
Vorherrschende Sprache
HTML
Sterne
67
Forks
69
Ø Merge
8 T. 8 Std.
Gemergte PRs (30 T.)
1

Beschreibung

It looks like the public purldDB API responds to the inclusion of a `#` subpath separator followed by the subpath value by ignoring the subpath. An example: in the public API, `https://public.purldb.io/api/packages/?purl=pkg:maven/org.elasticsearch/elasticsearch@7.17.9#fake/subpath` returns the same 2 records returned by `https://public.purldb.io/api/packages/?purl=pkg:maven/org.elasticsearch/elasticsearch@7.17.9` -- the only difference is the presence or absence of `#fake/subpath`.

I understand that this might be an encoding issue, but note that according to the [purl specification](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst#character-encoding), "the '#', '?', '@' and ':' characters must NOT be encoded when used as separators. They may need to be encoded elsewhere" and a bullet further below: "the '#' subpath separator must be encoded as %23 elsewhere". Perhaps the documentation needs to be clarified?

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.