Questions on encoding

[pombredanne]

from @maxhbr in #176 (comment)

A follow-up question, that is not scope of this PR, would be:

given the PURL pkg:swift/github.com%2FAlamofire/[email protected] is pkg:swift/github.com/Alamofire/[email protected] its canonical form?
If yes, it should be added to the test cases.

Or, for having more fun and with looking at #63 : what is the canonical form of pkg:golang/github.com%2Frussross%2Fblackfriday%[email protected]?

[ppkarwasz]

The string pkg:swift/github.com%2FAlamofire/[email protected] is not a valid PURL, since it contains an encoded slash / in the namespace and path segments can not contain slashes.

[pombredanne]

Good point. One more reason why namespace and name are crying to be merged in one :]

[ppkarwasz]

For me this example is the motivation why we spent so much time specifying the rules of character encoding: differences in the way different software handles encoding are a perfect vector for path traversal attacks. In the case of PURL, these would be supply chain attacks, e.g.:

pkg:swift/github.com/Alamofire/..%2F../example.com/Alamofire/Alamofire