Merge pull request #765 from actions/juxtin/allow-slashes-in-purls

Allow slashes in purl package names
actions · May 2, 2024 · 82ab8f6 · 82ab8f6
2 parents 0c155c5 + 432d8e7
commit 82ab8f6
Show file tree

Hide file tree

Showing 4 changed files with 37 additions and 4 deletions.
diff --git a/__tests__/purl.test.ts b/__tests__/purl.test.ts
@@ -44,6 +44,30 @@ test('parsePURL table test', () => {
         error: null
       }
     },
+    {
+      purl: 'pkg:golang/gopkg.in/DataDog/dd-trace-go.v1@1.63.1',
+      // Note: this purl is technically invalid, but we can still parse it
+      expected: {
+        type: 'golang',
+        namespace: 'gopkg.in',
+        name: 'DataDog/dd-trace-go.v1',
+        version: '1.63.1',
+        original: 'pkg:golang/gopkg.in/DataDog/dd-trace-go.v1@1.63.1',
+        error: null
+      }
+    },
+    {
+      purl: 'pkg:golang/github.com/pelletier/go-toml/v2',
+      // Note: this purl is technically invalid, but we can still parse it
+      expected: {
+        type: 'golang',
+        namespace: 'github.com',
+        name: 'pelletier/go-toml/v2',
+        version: null,
+        original: 'pkg:golang/github.com/pelletier/go-toml/v2',
+        error: null
+      }
+    },
     {
       purl: 'pkg:npm/%40ns%20foo/n%40me@1.%2f2.3',
       expected: {

diff --git a/dist/index.js b/dist/index.js
diff --git a/dist/index.js.map b/dist/index.js.map
diff --git a/src/purl.ts b/src/purl.ts
@@ -46,7 +46,10 @@ export function parsePURL(purl: string): PackageURL {
     namePlusRest = parts[1]
   } else {
     result.namespace = decodeURIComponent(parts[1])
-    namePlusRest = parts[2]
+    // Add back the '/'s to the rest of the parts, in case there are any more.
+    // This may violate the purl spec, but people do it and it can be parsed
+    // without ambiguity.
+    namePlusRest = parts.slice(2).join('/')
   }
   const name = namePlusRest.match(/([^@#?]+)[@#?]?.*/)
   if (!result.namespace && !name) {