Invalid purl: version must be percent-encoded

[kennylam91]

Hi, I encounter this error: Invalid purl: version must be percent-encoded when parse the purl pkg:npm/@vue/[email protected] with method PackageURL.fromString(). This purl was validated successfully by other library mvn:[email protected] in the backend.

When I look into the code of packageurl-js, I see this:

if (p.includes('@')) {
    let f = p.indexOf('@'),
      u = p.substring(f + 1)
    a = decodeURIComponent(u)
    let y = encodeURIComponent(a).replace(/%3A/g, ':').replace(/%2B/g, '+')
    if (u !== y)
      throw new Error('Invalid purl: version must be percent-encoded')
    i = p.substring(0, f)
}

I think it could have an issue because method indexOf() return the first matched index, but in this case pkg:npm/@vue/[email protected], it has another @ so f+1 is not the start of version substring.

[steven-esser]

@kennylam91 Thanks for the bug report, will take a look.

[jdalton]

This is fixed on master branch.

[kennylam91]

OK cool, will it be rolled out soon?

[jdalton]

@kennylam91

will it be rolled out soon?

I don't control that but after the next batch of patches lands I'll inquire!

[jdalton]

v2.0.0 has been published 🎉