Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Qualifier keys not validated #28

Open
matt-phylum opened this issue Nov 8, 2023 · 0 comments
Open

Qualifier keys not validated #28

matt-phylum opened this issue Nov 8, 2023 · 0 comments

Comments

@matt-phylum
Copy link

packageurl-dotnet neither percent encodes qualifier keys nor prevents characters that require percent encoding from being present in qualifier keys. The PURL spec says that keys must not be encoded, but this is only possible if the implementation prohibits characters that would require encoding. For example, packageurl-dotnet will deserialize the PURL pkg:t/n?%23=%23 as having a qualifier #=# and then serialize it as pkg:t/n?#=%23, which will parse as having a subpath of =# instead of a qualifier.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant