package-url / package-url/packageurl-java

Slash character is not expected to be escaped by the specification

Open
#122 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
48
Forks
26
PR merge metrics
No merged PRs in 30d

Description

This issue is created following https://github.com/package-url/purl-spec/discussions/293

Slash character in qualifiers appears to be escaped in the current implementation. For example the following code

//DEPS com.github.package-url:packageurl-java:1.5.0

import java.util.TreeMap;
import com.github.packageurl.PackageURL;

public class purl {
    public static void main(String[] args) throws Exception {

        final TreeMap<String, String> qualifiers = new TreeMap<>();
        qualifiers.put("type", "jar");
        qualifiers.put("repository_url", "https://maven.repository.redhat.com/ga/");
        var purl = new PackageURL(PackageURL.StandardTypes.MAVEN,
                    "org.apache.james",
                    "apache-mime4j-storage",
                    "0.8.9.redhat-00001",
                    qualifiers, null);
        System.out.println(purl);
    }
}

results in

pkg:maven/org.apache.james/apache-mime4j-storage@0.8.9.redhat-00001?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar

while following the spec it should be

pkg:maven/org.apache.james/apache-mime4j-storage@0.8.9.redhat-00001?repository_url=https://maven.repository.redhat.com/ga/&type=jar

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the qualifier serialization and encoding behavior in the Java implementation, then compare it with the package-url specification and the examples in this issue. Done means a slash in repository_url remains unescaped while other qualifier behavior and ordering continue to match the expected purl output.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.