packageurl-js
packageurl-js copied to clipboard
package-url
Splitting purl remainder from right on '@' to extract version
pkg:npm/@aws-crypto/[email protected] is technically an invalid PURL that most implementations should be able to handle anyway. The spec says "the '@' version separator must be encoded as %40 elsewhere". The correct PURL is pkg:npm/%40aws-crypto/[email protected], even if it looks ugly.
However, this PR does fix a spec conformance problem. The spec also says "Split the remainder once from right on '@'", which is not what the previous code was doing.
@matt-phylum The purl string pkg:npm/@aws-crypto/[email protected] was being accurately parsed using the python version of the module but js version was throwing error. But as you mentioned the python version does extract the version by splitting from the right on '@' (as required by the purl spec), thus the purl passed even without being percent-encoded.
Yeah I think this is the right thing to do, even if the % was supposed to be escaped.
I'm not a maintainer on this project so my approval doesn't mean anything.
