Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

#150 Prevent invalid URL generation #151

Closed
wants to merge 2 commits into from
Closed

#150 Prevent invalid URL generation #151

wants to merge 2 commits into from

Conversation

nhumblot
Copy link

@nhumblot nhumblot commented Jun 1, 2024

Hi! 👋

⚠️ This PR is my first proposal to this code base, please add the necessary extra care as I may not have a deep knowledge of it

Fix #150

As per its JavaDoc, PackageURL.percentEncode(String) is expected to encode the input in conformance with RFC 3986.

Regarding encoding, the specification states the following:

A percent-encoding mechanism is used to represent a data octet in a component when that octet's corresponding character is outside the allowed set or is being used as a delimiter of, or within, the component. A percent-encoded octet is encoded as a character triplet, consisting of the percent character "%" followed by the two hexadecimal digits representing that octet's numeric value. For example, "%20" is the percent-encoding for the binary octet "00100000" (ABNF: %x20), which in US-ASCII corresponds to the space character (SP). Section 2.4 describes when percent-encoding and decoding is applied.

When introducing a newline \n in the version field, it appears to be encoded as %A and makes the URL invalid, the good value being %0A

This PR aims to improve this requirement by checking the length of the hexadecimal encoded value and add a leading 0 when needed.

Your comments are welcomed, thank you for your time contributing to this project! 🙏

@nhumblot nhumblot closed this by deleting the head repository Aug 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Instanciating a PackagerURL with a version number containing a new line leads eventually to an invalid URL
1 participant