aboutcode-org / aboutcode-org/purldb

Public purldb API appears to ignore subpaths when submitted as part of a URL

Aberta
#536 2 comentários 0 reações 0 responsáveis Ver no GitHub
bug documentation
Linguagem predominante
HTML
Estrelas
67
Forks
69
Merge médio
8d 8h
PRs com merge (30d)
1

Descrição

It looks like the public purldDB API responds to the inclusion of a `#` subpath separator followed by the subpath value by ignoring the subpath. An example: in the public API, `https://public.purldb.io/api/packages/?purl=pkg:maven/org.elasticsearch/elasticsearch@7.17.9#fake/subpath` returns the same 2 records returned by `https://public.purldb.io/api/packages/?purl=pkg:maven/org.elasticsearch/elasticsearch@7.17.9` -- the only difference is the presence or absence of `#fake/subpath`.

I understand that this might be an encoding issue, but note that according to the [purl specification](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst#character-encoding), "the '#', '?', '@' and ':' characters must NOT be encoded when used as separators. They may need to be encoded elsewhere" and a bullet further below: "the '#' subpath separator must be encoded as %23 elsewhere". Perhaps the documentation needs to be clarified?

Guia de contribuição

Nenhum guia de contribuição indexado para este repositório

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.