refactor(sbom): disable html escaping for CycloneDX

[DmitriyLewen]

Description

Disable HTML escaping for CycloneDX.
Purl has already escaped all the necessary characters:
https://github.com/package-url/packageurl-go/blob/fe183c1943ec36f257fae7143e160978217104b6/packageurl.go#L369-L394

Related issues

• Close Invalid & qualifier escaping in purl of CycloneDX JSON #5763

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

I'm worried that disabling HTML escape has any side effects. For example, the description may have special characters.

[DmitriyLewen]

by default encoding/json package escapes special characters (for json).
e.g.:
vulnerability description: Description: jQuery before 3.4.0, as used" in Drupal
result - jQuery before 3.4.0, as used\" in Drupal

Do you think this is not enough?

[knqyf263]

So, why does CycloneDX apply HTML-escaping by default? Meaningless for us?

[ben-spiller]

CycloneDX doesn't apply HTML escaping. The Package URL format is based on URL syntax/escaping not HTML syntax/escaping, so any use of additional HTML escaping after the URL was generated makes it invalid and not conform to the specification.

[DmitriyLewen]

I didn't find info why we need to escape html characters.

I checked CycloneDX examples and component descriptions contain non-escaped characters - https://github.com/CycloneDX/bom-examples/blob/7d529848e2f8bd65d03aec9eab16f139fd445ff4/SBOM/juice-shop/via_npm/flat/bom.1.4.json#L50746

I asked about this in slack channel - https://cycledx.slack.com/archives/C01PZRT73K9/p1702444970519159.
Let's wait for an answer.

[DmitriyLewen]

Looks like we can merge this PR - https://cyclonedx.slack.com/archives/C01PZRT73K9/p1702549347993479?thread_ts=1702526083.019229&cid=C01PZRT73K9

[knqyf263]

Thanks for confirming!